7

When I download a browser such as Mozilla, it comes bundled with several root Certificates.

How do I trust that these certificates are legitimate? How do I know that my download does not contain some fake root certs?

I know that the software itself will go through an integrity check during the download (which rules out any tampering), however the integrity check itself relies on my existing browser trusting the browser which is being used to download Mozilla over HTTPS. Basically the Mozilla download itself relies on some other root certificate required somewhere during the download process. It seems to be a recursive problem.

So my question is how do I trust the root certificate built into my browser?

Improve this question
6
  • 2
    I know that the software itself will go through an integrity check during he download No. You need to do that manually.
    – deviantfan
    Commented Jul 23, 2016 at 0:06
  • How would the integrity of the cert in my browser be checked manually?
    – Minaj
    Commented Jul 23, 2016 at 0:32
  • I'm not talking about the cert, but the download. Often downloads are over HTTP, and a has can be found on a HTTPS site. (It also helps against technical transmission errors).
    – deviantfan
    Commented Jul 23, 2016 at 0:35
  • 1
    You mean a download such as that of mozilla is typically over HTTP?
    – Minaj
    Commented Jul 23, 2016 at 0:53
  • I just checked, as of now downloading Firefox from the website uses HTTPS. Other sources, like eg. Debians APT repositories, are HTTP. (Like I said, securing it is not necessary because a) The Program itself is no secret, everyone can download it, and b) The integrity+authenticity is checked against more thrustworthy data)
    – deviantfan
    Commented Jul 23, 2016 at 2:42

2 Answers 2

Reset to default
3

Firstly, you are right, it is a recursive problem. SSL is sort of a house of cards because you always have to trust something, including the folks that are telling you who to trust. A number of experts have predicted the collapse of SSL:

Security Collapse in the HTTPS Market

SSL/TLS encryption and the vacant lot scam: Too big to fail

How is SSL hopelessly broken? Let us count the ways

SSL and the future of authenticity

That being said, it is all we have for now, so panicking won't help.

If you're concerned that the program that you just downloaded also installed some malicious root certificates, there are scanners available to check them, such as this one and this one (Note: I can't recommend any of these because I haven't tried them, so do your research).

Or, if you wish to scan them manually, a pretty good list is maintained by Microsoft's Trusted Root Certificates Program.

Improve this answer
4
  • 1
    how does Mozila get the root certs in the first place? Do the mozilla folk go to Verisign or Godaddy with some media (such as a DVD) and get the copy of Verisign's root certificate? -- a process completely not on the internet?
    – Minaj
    Commented Jul 23, 2016 at 0:57
  • @Minaj: That is not necessary if they have any faith in the operating system and methodology which are closely related to this answer. In doubt, double-checking on a different machine using a different connection should be more than enough to satisfy the most paranoid. Beyond that, the only solution is a psychologist.
    – Julie Pelletier
    Commented Jul 23, 2016 at 1:23
  • You seem to suggest that I am personally scared or paranoid about something. I am only seeking to understand how it is done. So your mention of a psychologist is really off the point.
    – Minaj
    Commented Jul 23, 2016 at 4:55
  • @JuliePelletier That would be faith in that the hacker can't hack into both connections. Unlikely? yes. Impossible? No, especially for the NSA or big groups of motivated hackers. It seems to me that the only way to maintain trust is to deliver the root certificate by hand, which is only possible for small groups (like for example an intranet).
    – alx - recommends codidact
    Commented May 11, 2020 at 13:25
-2

Every operating system installer packages are signed. In Windows for example, when you download Firefox Installer Stub, you can check it's properties by right-clicking on the exe file and going to "Signature" tab:

Windows Exe File Properties

Then, click on "Details" to see more, you will see "Signer Information" and whatever it's "OK" which is checked with Windows built-in certificates.

Windows Exe Signature Details

Finally check the root certificate of the whole chain by googling the root certificate Thumbprint:

Digging out Thumbprint of Root Certificate

So in summary:

  1. Check if name of signer is "Mozilla Corporation"
  2. Check if digital signature is "OK"
  3. Check if the Root Certificate is OK

It seems Firefox binary root cert in the chain is this: https://assured-id-root.digicert.com/info/index.html - there's matching Thumbprint "05:63:B8:63:0D:62:D7:5A:BB:C8:AB:1E:4B:DF:B5:A8:99:B2:4D:43".

Similarly you can check every root certificate if you have doubts.

Improve this answer
2
  • 2
    Sorry but that's nonsense, the point is to verify Firefox and not the BIOS of the computer. The point is how to verify the root certs in general - you google the thumbprint.
    – Aria
    Commented Jul 23, 2016 at 1:21
  • 2
    "Every operating system installer packages are signed." Did you really meant that there are no operating systems which allow unsigned packages? Because that's how it reads.
    – techraf
    Commented Jul 23, 2016 at 4:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .