Six months ago or so, I thought I saw a reference to a web site that managed a current list of trusted certificate authorities. I can't find the reference any more.

What I'm looking for is an authoritative list of trusted CAs (and their root certificates would be nice) that I could use as a foundation to build a trust store without needing to rely on extracting that information from a browser or whatever. It would be ideal if it highlighted the addition and removal of various CAs on the list over time.

Does that sound familiar to anyone?

1 Answer 1


There is no generally trusted list of CA certificates, i.e. different browsers and OS might trust different CA. But there is a list of CA's trusted by Mozilla which is used in various other projects too. At CA certificates extracted from Mozilla you can download both the current CA certificates as PEM and also a script to extract the certificates from Mozillas trust store.

  • Why is this list hosted at haxx.se and not hosted at mozilla.org/en-US/about/governance/policies/security-group/… ?
    – Marcel
    Nov 27, 2019 at 6:21
  • @Marcel: The relevant information are hosted at Mozilla but not in a format usable by openssl, i.e. not as PEM. That's why haxx.se also provides a script to take the information from Mozilla and convert it in a suitable format. Nov 27, 2019 at 6:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .