3

Is there a common place where we can download all the root CA certs and get frequent updates for changes? This is one place where we can find the CAs, but we need to keep on checking for the updates. Are there any other places other than this one?

2
  • There are many DIFFERENT "trust store operators" that each have their own list of who is and who is not trustworthy. See this blog post for a project that attempts to track the big truststores: github.com/nabla-c0d3/nabla-c0d3.github.io/blob/master/_posts/… – StackzOfZtuff Jul 19 '18 at 10:11
  • Another example of differing lists is the Microsoft trust store vs the Mozilla trust store. The former includes the US FPKI (the Federal PKI of the United States), whereas the latter does not. – forest Jul 20 '18 at 3:41
3

Depending on your application, you might not need "all" the CA certificates, but only the ones that you are able to trust.

You can use the Mozilla CA Certificate Store at:

https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/

Those are the CAs that are trusted in e.g. Firefox.

2

In short, no there is n't.

A bit longer, there is no repository of all root CA's certificates. for example , private CA's are almost always not included in the CA list, also CA's with a limited scope are often not on those lists.

All major certificate keepers have there own list of CA's they thrust (and to what degree). This includes organizations like: Microsoft, Google, Mozilla, Sun, others. All have a method to have your CA certificate added to the list. (including a procedure of when are you added/removed and why)

Is there a reason to not trust the System's CA store?

if so I would also suggest the Mozilla CA store (in Daniels answer)

2
  • I need to download it manually to use in a wget that I have compiled for a custom system that has no cert repo. – charles Apr 19 at 12:56
  • 1
    @charles its extremely rare to have a system without any certificate store... but if you do have on... than yes you could download it from Mozilla. – LvB Apr 28 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.