I am working on an SSL implementation project and ofcourse I need to verify the certificate presented by the server. To do that I need CA certificates or at least root CA certificates (correct me I am wrong) but I cant seem to find any source which can give me certificate database. Where can I find all these certificates, preferably from single source? I know I can get certificates from all CAs separately but I am not comfortable with that method as it would make update process a mess. The closest thing that I could find was this file from mozilla http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt. Is this the right source for certificate database and if it is, how frequently this gets updated.

  • Try IE , Firefox browser keystores for a start !!
    – Arun
    Sep 26, 2013 at 5:17

3 Answers 3


It seems there is no single source to get all the keys. But looking at your requirements, starting with a credible browser's certificate database could be a good way to approach. The link you mentioned seems to be a good source. This perl script can download the certificates from the site and converts them from txt to PEM format.


This is not a very good idea. Collecting all CA's public keys from a single source brings up a few issues.

  1. You don't necesarrily want to trust all CAs. If you trust the public key of all CAs then anyone signing anything by way of any "CA" would appear valid. I could sign a certificate stating that my webserver was actually gmail, for example.

  2. Getting the public key of all CAs from a third party would allow that third party to change public keys around and then sign certificates using the name of an actually trustworthy policy. Things like this exist for personal public keys (email, etc) because you're supposed to verify the key with the person you're looking to communicate with. I'm not aware that this infrastructure exists, but even if it did you'd still need to verify the keys with each individual CA which is exactly what you state that you don't want to do.


The list of CA root certificates that your TLS implementation accepts is crucial to the security of your implementation's users. All it takes is one bad actor or front-for-NSA in that list to enable the compromise of all your users' connections.

While mozilla's list is a place to start, the best thing you could do for your users would be to vet all the CAs whose root certificates your implementation accepts.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .