Is there a way to verify a root CA cert bundle?

Question

I have on my linux machine a set of root CA certs. I'd like to make sure none of the CA certs are compromised or bogus.

Any suggestions on how to do this?

Answer 1

Usually known certificate authorities publish their root certificates on their websites.

For eg:

• Verisign has their list at: https://www.symantec.com/theme/roots
• Thwate has their list at: https://www.thawte.com/roots/

Ideally you'll check the certs you've got against equivalent fingerprints published on the respective websites.

On a linux machine, certs are stored at /etc/ssl/certs. The following command gives the fingerprint of a Thawte Primary Root CA G2 cert:

openssl x509 -in thawte_Primary_Root_CA_-_G2.pem -sha1 -fingerprint -noout

The fingerprint produced by the certs above can be looked up on the Thawte website. Similarly all root certs can be verified manually.

---

Caveat

The method above works for well known CAs like Verisign, Thawte. However there is no certain way to find out if the website of a lesser known root cert is legitimate. An attacker can somehow insert their root cert in your bundle and also host a website with the fingerprint of that cert. While not foolproof, general google search for each cert serial numbers + fingerprint pair should give enough pointers to vet most of the certs.

Also, comparing your certs with a good reference bundle, eg. one that comes with a fresh install of firefox, can be a good way to verify the certs. Obviously, the premise here is that you trust the firefox maintainers to make sure their build doesn't have a fake certificate. https://mozillacaprogram.secure.force.com/CA/IncludedCACertificateReport

Finally, who do you trust

Suppose you find a certificate which has no presence on google/internet. Sometimes, companies install their internal root CA certs in all employee PCs/laptops. This is on purpose to allow intranet sites to be signed by internal CAs (and avoid paying verisign for certs) as well as to MITM the connections of users (yes this is not uncommon). In such a case, it boils down to what entity do you consider as trusted and what entity is malicious. One needs to use their own judgement in such situations.

Answer 2

I think you'd pretty much have to do a byte comparison to known good ones (assuming they are popular CA certs).

Other mechanisms are in place to help with this also:

Subject Key Identifier (SKI). A certificate extension included in CA certificates that contains a hash of the CA certificate's public key. This hash is placed in the Authority Key Identifier (AKI) extension of all issued certificates to facilitate chain building.

Certificate Chaining. Certificate chaining is defined as the trust validation of an x.509 certificate as it is compared to a trust anchor such as a root certificate.

But you didn't give a lot of information regarding how they were generated or by whom.