5

I have a basic understanding of how the certificate authority ecosystem works. I know that when I'm connecting to a site, and they provide me with a certificate, my computer verifies the certificate's signature based on the trusted authorities stored locally. And I can follow the chain of authorities my computer trusts, verifying each certificate, until I reach one of my top level trusted CAs. Is there some way, outside the CA ecosystem, I can verify that my top level CAs are correct? Can I go visit them somewhere?

2
  • For most browsers (with Firefox and it's various derivatives being a notable exception), the root CA's that get used are provided directly via the OS, not by the browser, so you'll want to look into verifying those instead in most cases. Commented Oct 1, 2019 at 17:49
  • @AustinHemmelgarn Thanks, I updated my question Commented Oct 1, 2019 at 17:52

2 Answers 2

3

There are a few different ways:

  1. You can cross check with Common CA DB. Mozilla operates this site, but all of the major Root certificates stores vendors (Mozilla, Microsoft, Google, Cisco, and Apple) contributes data to the common database.

  2. All the major root certificate store maintainers publishes all the root certificate that they have in their root store on their respective websites: Mozilla, Microsoft, Apple, Android

  3. All the public Root CAs publishes all the public root certificates that they manage on their own websites, this is a requirement from CA/B Baseline Requirement which all public CAs that wants to issue certificates for websites have to comply with as part of their inclusion criteria in the root stores. Some examples: DigiCert, Comodo, GlobalSign, Let's Encrypt.

These sites publishes either the list of fingerprints of the certificates, or the root certificates themselves.

3
  • Of course if someone has gotten a bogus root(s) into your browser/platform truststore, they can MitM all those sites and alter them to show the bogus root(s) as 'legitimate'. Commented Oct 3, 2019 at 6:09
  • So I really would need to go on someone else's computer and check Commented Oct 3, 2019 at 13:01
  • @JaySchauer Yes (but then how do you know you can trust that computer?) The classic statement is "Reflections on Trusting Trust" (pdf). You could also, I suppose, try to write a (postal) letter to the Root CA and see if they reply. Of course, then you have to trust the postal service...
    – derobert
    Commented Oct 8, 2019 at 20:45
3

In most browsers, you should be able to view the certificate for a site, and follow the chain up to the root certificate. For example, in Firefox for security.stackexchange.com, you can follow the following steps, and see that the root certificate of the chain is DST Root X3.

1)  Navigate to security.stackexchange.com, and click the green padlock in the address bar
2)  Click the right arrow, next to 'Secure Connection'.
3)  Click 'More information'
4)  Click 'View Certificate'
5)  Click 'Details'

Then, look at the certificate hierarchy. You should see the following chain:

DST Root CA X3
  + Let's Encrypt Authority X3
    + *.stackexchange.com
3
  • Yes, but how can I trust the the root certificate's public key is correct? Commented Oct 1, 2019 at 18:32
  • Yes, but the root certificate signature is self signed. Is there some external source I can check to verify the root certificate? Commented Oct 1, 2019 at 18:38
  • On my system, I was able to find the DST_Root_CA_X3.crt certificate file, and view the contents of this file, and verify that the contents of this file matches the certificate posted on IdenTrust's site at identrust.com/dst-root-ca-x3. This certificate is mirrored on many other sites as well.
    – mti2935
    Commented Oct 1, 2019 at 18:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .