Deletion of trusted root certificate store folders in a product

Question

I'm developing a headless linux based industrial safety product. It is very much limited to work with only known sources/hosts. Can I safely delete the trusted root certificates provided by the OS and Mozilla. Though I had not enabled mozilla in my target packages configuration, I see the certificates in the Root File system.

I do have some use cases for TLS communication, but it uses my own organization's two-tier PKI CA environment and the CA-bundle is explicitly included in the root file system using overlay feature.

So can I safely delete the below folder contents?

• OS provided trusted root cert store /etc/ssl/certs/
• Mozilla provided trusted root cert store /usr/share/ca-certificates/mozilla/

Answer 1

Yes, you can.

If your appliance is not designed to communicate with any external hosts, then creating your own certificate store, which only includes CA's you manage, is a reasonable thing to do.

It doesn't really add that much security, given that breaches of any of those CA's are very unlikely, but it doesn't have any negative effects either.

---

While it is not 100% directly your question, there is a design pattern many developers fall into that can lead to vulnerabilities.

Many developers use client certificates signed by a CA they control in order to provide a mechanism for authentication. However, they only check if the certificate is valid - not if it is actually signed by their own CA. This means an attacker can generate a valid client certificate through a public, trusted CA and use that to authenticate with the service.

While deleting all external CA's would solve this problem too, the inclusion of a check whether or not the presented client certificate is signed by the correct CA is a much better solution.