0

When I check Google's certificate (from browser), I notice the root certificate is GTS Root R1. However, I don't see this root certificate in certificate manager.

Whereas for microsoft.com or oracle.com the root certificates are DigitCert Global Root G2 and Digital Global Root CA respectively. And I can see both of these root certs in the certificate manager.

Note: For Google root cert, I validated by looking friendly name in certificate manager. But unable to find google root certificate under trusted root store.

Despite not able to see Google's root certificate in certificate manager, why does the browser still show connection to google as secure?

Improve this question
1
  • Google now comes with its own root CA, similar on what Firefox does for many years. Thus, don't look into the certificate manager but instead in the Chrome settings. See blog.chromium.org/2022/09/…
    – Steffen Ullrich
    Apr 1 at 7:26

1 Answer 1

Reset to default
1

I don't know what browser or OS you're using, or what website you visited, but:

GTS Root R1 has self-signed certificates, but it also has a certificate issued by GlobalSign's GlobalSign Root CA, an older and widely-trusted CA. (The two crt.sh links show this in the Certificates and Parent and Child CAs sections.)

If I access https://www.google.com/ right now, the certificate chain I see is:

  1. www.google.com issued by GTS CA 1C3
  2. GTS CA 1C3 issued by GTS Root R1
  3. GTS Root R1 issued by GlobalSign Root CA

If GTS Root R1 is in your trust store, you can short-circuit validation at that point and trust the certificate. If it's not, you can validate the GTS Root R1 certificate if you trust GlobalSign Root CA.

If Google didn't want to rely on GlobalSign Root CA, they wouldn't serve the last certificate in the chain at all.

The practice of bootstrapping new CAs using older CAs is quite common, and is referred to as cross-signing.

Sometimes a new CA buys an entire root certificate from another CA that has several roots and can afford to part with one for the right price -- in fact, Google acquired GlobalSign Root CA - R2 from GlobalSign, but it expired in 2021 and they had to switch to the current solution.

Google blogged about the change at the time.

(P.S. The industry has gone through so many mergers, acquisitions and rebrandings since the 1990s that the name of a CA certificate and the name of the company that owns it can be completely different, even if the certificate itself has never directly changed hands.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .