I have a basic understanding of how the certificate authority ecosystem works. I know that when I'm connecting to a site, and they provide me with a certificate, my computer verifies the certificate's signature based on the trusted authorities stored locally. And I can follow the chain of authorities my computer trusts, verifying each certificate, until I reach one of my top level trusted CAs. Is there some way, outside the CA ecosystem, I can verify that my top level CAs are correct? Can I go visit them somewhere?
There are a few different ways:
You can cross check with Common CA DB. Mozilla operates this site, but all of the major Root certificates stores vendors (Mozilla, Microsoft, Google, Cisco, and Apple) contributes data to the common database.
All the public Root CAs publishes all the public root certificates that they manage on their own websites, this is a requirement from CA/B Baseline Requirement which all public CAs that wants to issue certificates for websites have to comply with as part of their inclusion criteria in the root stores. Some examples: DigiCert, Comodo, GlobalSign, Let's Encrypt.
These sites publishes either the list of fingerprints of the certificates, or the root certificates themselves.
In most browsers, you should be able to view the certificate for a site, and follow the chain up to the root certificate. For example, in Firefox for security.stackexchange.com, you can follow the following steps, and see that the root certificate of the chain is DST Root X3.
1) Navigate to security.stackexchange.com, and click the green padlock in the address bar 2) Click the right arrow, next to 'Secure Connection'. 3) Click 'More information' 4) Click 'View Certificate' 5) Click 'Details'
Then, look at the certificate hierarchy. You should see the following chain:
DST Root CA X3 + Let's Encrypt Authority X3 + *.stackexchange.com