Someone is running an automated scan on our SSL setup and they insist that our root certificate be included in all the following CA stores:

  • "Mozilla NSS - 01/2014"
  • "Apple - OS X 10.9.2"
  • "Java 6 - Update 65"
  • "Microsoft - 04/2014"

Now, I could argue about the list of CA stores they are using for their tests but this is not going to be a productive discussion so, I am looking for a way to find the exact list of certificates included in the above CA stores, and derive from that a list of vendors who are going to sell me a valid certificate signed by a root certificate present in all the above CA stores.

Hence, my questions, potentially dumb or naive, sorry for that:

  1. For example, how do I know what certificates are included in "Mozilla NSS - 01/2014" ? I thought it would be easy to google for that string and find matching certificates but it's not. I tried to find a matching nss release for that data but I can't find any information about which nss version might have been released on jan 2014.

  2. How do I know which vendors might sell certificates that are indirectly signed by a specific root certificate ?

  3. Am asking the wrong questions given the problem ?

  • I eventually figured out that they are using sslyze (github.com/iSECPartners/sslyze). A git clone helped figure out that the above-mentionned CA stores were defined in github.com/iSECPartners/sslyze/commit/… So, now, I have the content of these CA stores and I can trivially calculate the intersection of them all. Then, I need to answer question 2: how can I find who sells certificates derived from one of these root certificates ?
    – mathieu
    Sep 16 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.