1

I'm developing a headless linux based industrial safety product. It is very much limited to work with only known sources/hosts. Can I safely delete the trusted root certificates provided by the OS and Mozilla. Though I had not enabled mozilla in my target packages configuration, I see the certificates in the Root File system.

I do have some use cases for TLS communication, but it uses my own organization's two-tier PKI CA environment and the CA-bundle is explicitly included in the root file system using overlay feature.

So can I safely delete the below folder contents?

  • OS provided trusted root cert store /etc/ssl/certs/
  • Mozilla provided trusted root cert store /usr/share/ca-certificates/mozilla/

1 Answer 1

1

Yes, you can.

If your appliance is not designed to communicate with any external hosts, then creating your own certificate store, which only includes CA's you manage, is a reasonable thing to do.

It doesn't really add that much security, given that breaches of any of those CA's are very unlikely, but it doesn't have any negative effects either.


While it is not 100% directly your question, there is a design pattern many developers fall into that can lead to vulnerabilities.

Many developers use client certificates signed by a CA they control in order to provide a mechanism for authentication. However, they only check if the certificate is valid - not if it is actually signed by their own CA. This means an attacker can generate a valid client certificate through a public, trusted CA and use that to authenticate with the service.

While deleting all external CA's would solve this problem too, the inclusion of a check whether or not the presented client certificate is signed by the correct CA is a much better solution.

1
  • Thanks for the answer. The description makes a lot of sense. Dec 13, 2020 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.