I have a web server, Debian, and the site uses a HTTPS cert from Thawte. The root certificate meant to be on top of my verification chain is also on the server, in /etc/ssl/certs, because the APT packet ca-certificates in installed (the actual content of the certificate list Debian uses there apparently comes from Mozilla).
Now I checked the same root certificate from 4 different locations:
a) The file in /etc/ssl/certs, coming from packet ca-certificates
b) The file contained in a fresh download of said APT packet, on a WIndows PC, just to look at the files
c) The root certificate downloaded from Thawtes website itself
d) The root certificate as used by my browser, Firefox, on Windows.
The problem is, only the debian-related ones (a and b) are the same, ie. I have three different certificates there. Name, fingerprint etc. are always the same, but the public key and some other values are completely different.
My question: Is this normal? Or do I have a huge reason to worry now?
I noticed that because I can't verify my site certificate on the server (SSH, with OpenSSL in the command line); OpenSSL isn't satisfied with the local CA files.