0

So I notice that a lot of different products and systems seem to have their own version of CACerts or generically, a file containing a collection of trusted Certificate Authority certificates. For example the Java SDK has cacerts, Mozilla, and other browsers have their own versions. In addition I see a couple of Linux packages have their own versions. And of course there are Microsoft and Apple versions.

Is there a single maintained source of truth (ummmm Trust?) for Certificate Authority Root Certificates? Whom do you trust?

3

Every Root Certificate programs have different requirements for including an Authority in their root store, that is why there's no single truth, because they're all truth according to their respective root program's requirements.

The root program's requirements in all major browsers are more or less aligned with the CA/B Forum Baseline Requirements, but each root program are allowed to add more requirements, which leads to different browsers shipping with slightly different set of root certificates.

Whom do you trust?

Trust is a complicated thing, it's not binary. The fact that I trust Mozilla's Root Certificate program for verifying certificates for web servers during my daily browsing, does not necessarily mean that I trust them for code signing of my company's internal code signing authority for software that we develop, run, and deploy. And neither does the fact that I trust my internal code signing authority for signing these software means that I trust them to certify web sites that I visit using my work computer.

If trust is really important to you, you will want to verify yourself which part of the root program's requirement matches your own requirements, and which ones of your requirements are not satisfied and for which you may need to do separate verifications.

Note that most public Certificate Authority root program are concerned about identity, rather than the ethics, competence, or even legality of the business practice of the organizations they sign for.

  • You have pointed out a few things I had not considered. Thank you for the education. – garthoid Jun 20 '17 at 17:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.