I'm talking about SSL/TLS certificate authorities. I know that they store their private key on a very secure location. but what about their public key that our browsers use to make sure the signatures are actually signed by the certificate authority we are talking about, where is that public key stored?

Is it possible to edit these public keys thus by having physical access to someone's web browser/computer can an attacker change those public keys to their own public keys and render the CA on that particular computer/web browser useless?

closed as unclear what you're asking by Tobi Nary, ThoriumBR, Eric G, David, M'vy Jan 30 '18 at 9:17

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I‘m really not sure what you’re asking and I think there might be words missing in at least one sentence. Can you try and rephrase your question? – Tobi Nary Jan 28 '18 at 11:14
  • @SmokeDispenser What exactly is that you didn't understand? – ATheCoder Jan 28 '18 at 11:19
  • - you cannot store anything on a location, - the next sentence is incomprehensible, - I’m not sure what the goal would be. Do you even know how certificates work? If you got access to the trust store, you could add your own certificate. That would be way more powerful than destroying certificates that can easily be recreated. – Tobi Nary Jan 28 '18 at 11:23
  • @SmokeDispenser I meant the server containing the private key. and You do not have access to the trusted store, that is like having access to the private key. I'm talking about the public key that is used by the web browser to validate the already issued certificate's signature; To make sure that the Certificate is actually Issued by the CA and not by anyone else claiming to be that CA. – ATheCoder Jan 28 '18 at 11:44
  • Yeah, you need to look up what a trust store is. And also, how certificate signing works. If you still have questions then, maybe you are able to bring them across in a coherent way. – Tobi Nary Jan 28 '18 at 11:45

The public key of the CA is stored in the certificate of the CA. And this certificate is stored in the local trust store on the clients system. It is true that an attacker which has access to the local trust store could replace existing CA certificates or add new ones. But if the attacker has this kind of access he can do lot more harm anyway, like replacing the existing software on the system with a similar one having a backdoor or other malicious behavior.

For more information see SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? .

  • My question is how does the web browser know that the signature is valid? – ATheCoder Jan 28 '18 at 12:27
  • That in fact the signature is signed by the Issuing CA? – ATheCoder Jan 28 '18 at 12:27
  • @TheGreatA: I'm not sure what you are asking. How to find out which CA has issued the certificate is described in the link I've provided. If you want to know how digital signatures work and thus how to verify that a signature is valid and not corrupted see how digital signature verification process works. – Steffen Ullrich Jan 28 '18 at 12:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.