A lot of trust on computer systems rely on the CA certificates used to verify the authenticity of websites (typically HTTPS), so it is of utmost importance that these certificates are valid and not tampered with by suspect third parties

Not sure if this is the case but I find it likely that on mobile platforms, at least some certificates (at least those from the manufacturer and OEM) come pre-installed via firmware. In linux systems they can be stored in /usr/local/share/ca-certificate or /etc/ssl/certs, on Mac OS it is /System/Library/Security/Certificates.bundle/Contents/Resources/TrustStore.html, and so on. These certificates can vary from OS and from version.

I wonder if there are tools that allow to validate the certificates installed on a machine against public CA databases, and detect any potentially anomalous certificate


There is no such thing in this case as an invalid root CA. You trusted root CAs on your Windows vs Linux vs any other device just like you mentioned. I a vendor decides to install their additional root CA as a trusted CA they can do it nothing invalid about it. However the attack vector would require the attacker to also MITM the target site. So if the attacker is trying to intercept cnn.com traffic they would have to either hijack traffic and use their certificate that would be trusted on your device or redirect you to a different address with a clone site with again a different certificate but one that would look trusted from your device perspective.

You probably could easily list your existing root CAs and compare them to known root CA lists and see if there's an outlier

  • There is no such thing in this case as an invalid root CA - This is not correct. 1) For instance, the vendor could have installed a self-signed certificate not known to the major CAs. If such device is used in the office of some company and they see the whole traffic, they can easily do MITM and decrypt the traffic. 2) There can be correct certificates, which are outdated (and thus invalid) or certificates signed by some outdate CA certificates. Etc. That's why the question is understandable. – mentallurg Apr 8 at 22:22
  • You probably could easily - If it was possible, this question would not be asked. This question means, that it is not possible to easily do that. That's why the author is looking for a tool. – mentallurg Apr 8 at 22:25
  • Questions about recommendations of tools, products etc. are out of scope on this site. – mentallurg Apr 8 at 22:25
  • @mentallurg any suggestions how to reword the concerns so that it remains on-topic? – lurscher Apr 9 at 10:46
  • @lurscher: Other wording will not help. What you are looking for is a tool or a product. They change over the time, some tolls are not more supported, the new tools appear. And tools that some users find good the others find bad. Where as the goal of this site is to provide answers that are valid for a long time. That's why questions about recommendations as well as opinion-based questions are out of scope on this site. – mentallurg Apr 9 at 12:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.