I was asked "how do browsers know whether or not to trust the certificate from the server it's connecting to" and thought it was a pretty good question. After doing some googling I found two answers:
According to this person a list of root content authorities are built into the operating system, and any further CA's are trusted (or not) by the root ones.
Just so you know, Microsoft determines which Trusted Root CAs are automatically loaded into their operating system. It’s the same story with Apple.
However Wikipedia makes it sound like it sound like the list of trusted CAs is built into the web browser:
The browser already possesses the public key of the CA and consequently can verify the signature, trust the certificate and the public key in it
So which is it? Does both the operating system and browser come with a built in list of trusted certificate authorities and if a certificate is signed by an entry in either one of the list it's trusted?