When I download a browser such as Mozilla, it comes bundled with several root Certificates.

How do I trust that these certificates are legitimate? How do I know that my download does not contain some fake root certs?

I know that the software itself will go through an integrity check during the download (which rules out any tampering), however the integrity check itself relies on my existing browser trusting the browser which is being used to download Mozilla over HTTPS. Basically the Mozilla download itself relies on some other root certificate required somewhere during the download process. It seems to be a recursive problem.

So my question is how do I trust the root certificate built into my browser?

  • 2
    I know that the software itself will go through an integrity check during he download No. You need to do that manually. – deviantfan Jul 23 '16 at 0:06
  • How would the integrity of the cert in my browser be checked manually? – Minaj Jul 23 '16 at 0:32
  • I'm not talking about the cert, but the download. Often downloads are over HTTP, and a has can be found on a HTTPS site. (It also helps against technical transmission errors). – deviantfan Jul 23 '16 at 0:35
  • 1
    You mean a download such as that of mozilla is typically over HTTP? – Minaj Jul 23 '16 at 0:53
  • I just checked, as of now downloading Firefox from the website uses HTTPS. Other sources, like eg. Debians APT repositories, are HTTP. (Like I said, securing it is not necessary because a) The Program itself is no secret, everyone can download it, and b) The integrity+authenticity is checked against more thrustworthy data) – deviantfan Jul 23 '16 at 2:42

Firstly, you are right, it is a recursive problem. SSL is sort of a house of cards because you always have to trust something, including the folks that are telling you who to trust. A number of experts have predicted the collapse of SSL:

Security Collapse in the HTTPS Market

SSL/TLS encryption and the vacant lot scam: Too big to fail

How is SSL hopelessly broken? Let us count the ways

SSL and the future of authenticity

That being said, it is all we have for now, so panicking won't help.

If you're concerned that the program that you just downloaded also installed some malicious root certificates, there are scanners available to check them, such as this one and this one (Note: I can't recommend any of these because I haven't tried them, so do your research).

Or, if you wish to scan them manually, a pretty good list is maintained by Microsoft's Trusted Root Certificates Program.

  • how does Mozila get the root certs in the first place? Do the mozilla folk go to Verisign or Godaddy with some media (such as a DVD) and get the copy of Verisign's root certificate? -- a process completely not on the internet? – Minaj Jul 23 '16 at 0:57
  • @Minaj: That is not necessary if they have any faith in the operating system and methodology which are closely related to this answer. In doubt, double-checking on a different machine using a different connection should be more than enough to satisfy the most paranoid. Beyond that, the only solution is a psychologist. – Julie Pelletier Jul 23 '16 at 1:23
  • You seem to suggest that I am personally scared or paranoid about something. I am only seeking to understand how it is done. So your mention of a psychologist is really off the point. – Minaj Jul 23 '16 at 4:55

Every operating system installer packages are signed. In Windows for example, when you download Firefox Installer Stub, you can check it's properties by right-clicking on the exe file and going to "Signature" tab:

Windows Exe File Properties

Then, click on "Details" to see more, you will see "Signer Information" and whatever it's "OK" which is checked with Windows built-in certificates.

Windows Exe Signature Details

Finally check the root certificate of the whole chain by googling the root certificate Thumbprint:

Digging out Thumbprint of Root Certificate

So in summary:

  1. Check if name of signer is "Mozilla Corporation"
  2. Check if digital signature is "OK"
  3. Check if the Root Certificate is OK

It seems Firefox binary root cert in the chain is this: https://assured-id-root.digicert.com/info/index.html - there's matching Thumbprint "05:63:B8:63:0D:62:D7:5A:BB:C8:AB:1E:4B:DF:B5:A8:99:B2:4D:43".

Similarly you can check every root certificate if you have doubts.

  • 2
    Sorry but that's nonsense, the point is to verify Firefox and not the BIOS of the computer. The point is how to verify the root certs in general - you google the thumbprint. – Aria Jul 23 '16 at 1:21
  • 2
    "Every operating system installer packages are signed." Did you really meant that there are no operating systems which allow unsigned packages? Because that's how it reads. – techraf Jul 23 '16 at 4:48

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.