How do certificate issuers become trusted?

Question

From what I understand, the certificate scheme that TLS/SSL relies on works because your computer has trust for major CA issuers built into it.

That is, your OS is installed with certificates for some of the major signers.

I have so many questions about this, but I'll start with the most basic:

Does this mean it is impossible to add new trusted certificate issuers forever? Is it impossible for one to start his or her own root CA without the consent of computer manaufacturers?

Also, what is stopping an attacker from simply installing "trusted" certificates in people's computers?

Answer 1

Is it impossible for one to start his or her own root CA without the consent of computer manaufacturers?

Everybody can create it's own CA and install it on all computers s(he) has control to. It is not unusual for larger companies to have their own internal CA.

Also, what is stopping an attacker from simply installing "trusted" certificates in people's computers?

Existing security measures should in theory make it impossible for an attacker to install additional certificates on machines owner by others. But if the attacker manages to get access to the machine (malware, physical access, deal with the vendor...) adding another trusted CA is possible. This is actually done in practice, see Superfish.

Apart from attacks new trusted root CA gets typically added in companies to support their own infrastructure or to make analysis of SSL traffic in firewalls possible (SSL interception). For SSL analysis also several personal antivirus solution install such new root certificates.

Answer 2

Does this mean it is impossible to add new trusted certificate issuers forever? Is it impossible for one to start his or her own root CA without the consent of computer manaufacturers?

A new CA can be created and have its certs added to the trusted list with cooperation from manufacturers. This could be the computer manufacturer, the OS manufacturer or the browser manufacturer. For example the letsencrypt.org initiative would require browsers to have the cert added in the trusted list (which will be done).

It is also possible for a CA to be removed from a trusted list. This has happened recently.

Just to clarify, as other posters mentioned a user can always make their own certs and trust them. This makes them a CA but this is not a good idea as it defeats the purpose of a CA (a third party that verifies the legitimacy of a certificate). These days there are projects like letsencrypt that hope to make it easy and very cheap for people to get access to certs for their domains that are trusted by manufacturers. Truly a sign of the times!

Also, what is stopping an attacker from simply installing "trusted" certificates in people's computers?

Any user with admin privileges can add a trusted cert on a system. On top of that for browsers any user can just tell their browser to always trust a cert.

Dell did this recently by preinstalling a cert they created themselves, and accidentally including the private key with it.

Answer 3

Does this mean it is impossible to add new trusted certificate issuers forever? Is it impossible for one to start his or her own root CA without the consent of computer manaufacturers?

How can my organization become a Root CA?

what is stopping an attacker from simply installing "trusted" certificates in people's computers?

Admin privilege is required to add the certificate on your system. On windows machine, you can check the certificates installed by typing certmgr.msc in "Run" dialog box. There you can see all the certificates pre-installed on your system. You can add your own self signed certificates there but one must be careful before doing so. What's the risk of using self-signed SSL?

Answer 4

Does this mean it is impossible to add new trusted certificate issuers forever? Is it impossible for one to start his or her own root CA without the consent of computer manufacturers?

It's not impossible to add new trusted certificate forever.
It is possible to start your own CA. But only problem is that you can't install it on all other computers without the consent of manufacturers either hardware or software manufacturers (browsers and software normally).

Also, what is stopping an attacker from simply installing "trusted" certificates in people's computers?

On-board security measures like user privileges, external ones like antivirus software, and browser security measures ensure that unwanted certificates are not installed in our systems.