I have a basic understanding of how the certificate authority ecosystem works. I know that when I'm connecting to a site, and they provide me with a certificate, my computer verifies the certificate's signature based on the trusted authorities stored locally. And I can follow the chain of authorities my computer trusts, verifying each certificate, until I reach one of my top level trusted CAs. Is there some way, outside the CA ecosystem, I can verify that my top level CAs are correct? Can I go visit them somewhere?

  • For most browsers (with Firefox and it's various derivatives being a notable exception), the root CA's that get used are provided directly via the OS, not by the browser, so you'll want to look into verifying those instead in most cases. Oct 1 '19 at 17:49
  • @AustinHemmelgarn Thanks, I updated my question Oct 1 '19 at 17:52

There are a few different ways:

  1. You can cross check with Common CA DB. Mozilla operates this site, but all of the major Root certificates stores vendors (Mozilla, Microsoft, Google, Cisco, and Apple) contributes data to the common database.

  2. All the major root certificate store maintainers publishes all the root certificate that they have in their root store on their respective websites: Mozilla, Microsoft, Apple, Android

  3. All the public Root CAs publishes all the public root certificates that they manage on their own websites, this is a requirement from CA/B Baseline Requirement which all public CAs that wants to issue certificates for websites have to comply with as part of their inclusion criteria in the root stores. Some examples: DigiCert, Comodo, GlobalSign, Let's Encrypt.

These sites publishes either the list of fingerprints of the certificates, or the root certificates themselves.

  • Of course if someone has gotten a bogus root(s) into your browser/platform truststore, they can MitM all those sites and alter them to show the bogus root(s) as 'legitimate'. Oct 3 '19 at 6:09
  • So I really would need to go on someone else's computer and check Oct 3 '19 at 13:01
  • @JaySchauer Yes (but then how do you know you can trust that computer?) The classic statement is "Reflections on Trusting Trust" (pdf). You could also, I suppose, try to write a (postal) letter to the Root CA and see if they reply. Of course, then you have to trust the postal service...
    – derobert
    Oct 8 '19 at 20:45

In most browsers, you should be able to view the certificate for a site, and follow the chain up to the root certificate. For example, in Firefox for security.stackexchange.com, you can follow the following steps, and see that the root certificate of the chain is DST Root X3.

1)  Navigate to security.stackexchange.com, and click the green padlock in the address bar
2)  Click the right arrow, next to 'Secure Connection'.
3)  Click 'More information'
4)  Click 'View Certificate'
5)  Click 'Details'

Then, look at the certificate hierarchy. You should see the following chain:

DST Root CA X3
  + Let's Encrypt Authority X3
    + *.stackexchange.com
  • Yes, but how can I trust the the root certificate's public key is correct? Oct 1 '19 at 18:32
  • Yes, but the root certificate signature is self signed. Is there some external source I can check to verify the root certificate? Oct 1 '19 at 18:38
  • On my system, I was able to find the DST_Root_CA_X3.crt certificate file, and view the contents of this file, and verify that the contents of this file matches the certificate posted on IdenTrust's site at identrust.com/dst-root-ca-x3. This certificate is mirrored on many other sites as well.
    – mti2935
    Oct 1 '19 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.