3

Just saw a piece of news about potential issues with TrustCor root CA.

I don't see the TrustCor root CA in windows certificate manager.

I do see it in Firefox cert store.

Browsing to trustcor.com in Chrome under Windows 10 works fine showing a padlock icon.

Viewing the site's cert shows this at the root: TrustCor RootCert CA-2

AFAIK, Chrome uses Windows cert store but again that root CA doesn't seem to be there.

How's this site trusted by Chrome? Possible cross signing?

1

1 Answer 1

1

Chrome uses the system certificates under Windows, but also a select few others, list at https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/root_store.md

Chromium Root CA policy explains it all.

TrustCor is one of them, no shenanigans here.

December 2022 edit : Trustcor was in fact very shady and is getting removed from some trust stores, possibly more later : https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/WJXUELicBQAJ

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .