0

Is there any tool out there that will monitor my system's use of root CAs? So far I have not found anything, and so I am hoping that this community will know if such a tool exists.

For background, I use Windows, which comes with its own certificate store, Chrome (uses the Windows certs), and Firefox (uses its own trusted certificates).

I live in an English language country, and am unlikely ever to use a large portion of the Internet. So there are root CAs I do not think I need to trust; Hong Kong Post Office comes to mind as one I would rather not trust.

What I don't know is which root certificates my system and browsers have interacted with. It is always possible that some Very Important Site uses the Hong Kong PO as its signing authority, and I have no way of knowing without stumbling upon that site after deleting the certificate.

The ideal solution would be to track which root CAs are being referred to by the system/browser, so over time I could remove trust from the ones that are never used by the OS or the browser/s. I would potentially stumble across occasional errors when I have removed particular certificates that some random website or system tool uses, but could presumably just reinstall the relevant certificate if I cared enough about the error.

Oh - according to this answer Windows will automatically install certificates it trusts as needed (although this can allegedly be disabled). That suggests that I cannot easily control my own level of trust.

Improve this question
5
  • Chrome has started its own root program (which BTW does include HongKong PO and 6 in 'real' China) but as of now still accepts the host=Windows store; Firefox added an option some time ago to add the host store to its own.
    – dave_thompson_085
    Commented Nov 23, 2023 at 1:53
  • Hi, does any answer fits your needs? If so, do you mind accepting the "answer"? (cf. meta.stackexchange.com/questions/5234/…). This will help us and future visitors. If not, please let us know what's missing
    – bsaverino
    Commented Jan 2 at 1:47
  • Thank you for the helpful reminder, @bsaverino . I was not entirely sure what to do if neither answer fully addressed my question (i.e. there does not appear to be a consumer-grade tool for logging certificate use). As the root issue (pun intended) is deciding which CAs I can safely distrust I have gone with the answer detailing the most popular CAs - though I am not yet ready to distrust most of the dozens of other certificates in my root store/s.
    – Cogitative
    Commented Jan 3 at 6:48
  • OK I see. What do you mean however by "safely distrust"? And what is the goal of this elagging? (that goes beyond monitoring and is not related to interception then).
    – bsaverino
    Commented Jan 3 at 12:56
  • The goal is to have a minimum number of trustworthy certificates in my store so I can access English-language websites without: 1. A root certificate issued by an entity that I do not feel is trustworthy. (This is the complicated bit - figuring out who I trust.) 2. Hitting an error message when I try to access a website that is on the fringes of popularity (e.g. a random user blog that happens to have some interesting information). The logging of certificate use is a first step that says which certificates I do not use, but at this point it seems unlikely.
    – Cogitative
    Commented Jan 5 at 1:15

2 Answers 2

Reset to default
0

According to this Wikipedia article, a study of the Alexa top 10 million web sites done in April 2023 found that the issuing CA's of the certificates used to secure these sites breaks down as follows:

Rank  Issuer                          Usage
1     IdenTrust                       38.5%
2     DigiCert                        13.1%
3     Sectigo (Comodo Cybersecurity)  12.1%
4     GlobalSign                      16.1%
5     Let's Encrypt                   5.8%

As you can see, nearly 90% of the top 10 million sites on the web are secured using certificates issued by just five CA's.

You might want to start by including just the root certificates for these CA's in your trust store. Then, as you surf the web - when you come across a site whose certificate is issued by a CA other than one of these, you can selectively decide whether or not to include this CA's root certificate in your trust store on a case-by-case basis.

Improve this answer
1
0

To my opinion your best shot would be to look at forward proxies that provides TLS interception and inspection. XDR solutions often feature such functionalities as well. Seen that the proxy has to intercept certificates and rewrite them, it can theoretically give insights on trust and root CAs.

Vendors like PaloAlto, Checkpoint, F5 and certainly some opensource tools can provide you with the auditing feature you need. However I would not dare to weight here on the capabilities of each solution.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .