This is what facebook ships with their API php client: https://github.com/facebook/facebook-php-sdk-v4/blob/master/src/Facebook/fb_ca_chain_bundle.crt

It contains dozens (hundreds?) Root CAs.

But doesn't it make the client more prone to MitM attack?

To clarify why I think: it's more chance that some of CA certificates will be compromised, than if they included a single certificate - the exact one they sign their certificates.

Am I missing something?

1 Answer 1


Like written in the File Head, this file is basicly just a copy of the CAs from Mozilla. This allows the use in cURL, to check if the Certicate is valid or not.

It is not like this would be tons of additional random CAs, it is just a copy of something the most browser will already have, just attached to use it with cURL or anything else.

An issue could be if one CA gets compromised, you had to remove it manually from the file, since it is not bound to any updater like a browser.

  • 1
    That's right. I understand it's just an as-is copy. The question is - why does FB ships the whole file not just 1 (or several) CAs that are really relevant to them?
    – zerkms
    Jun 5, 2014 at 20:18
  • That is a good question, it is unneccesary most likely, but I just wanted to answer that it is not a security risk.
    – D. Schalla
    Jun 5, 2014 at 22:20
  • "it is not a security risk" --- it is. If one certificate is compromised - all clients are in danger. And all clients will have to upgrade their code. Which, as you understand, is not the case - it's unlikely even half of them will ever upgrade or notice it. Hence millions of clients will run obsolete certificates bundle.
    – zerkms
    Jun 5, 2014 at 22:47
  • It is not an additional security risk if you: A) Keep the SDK updated and B) Check if they update the CAs.
    – D. Schalla
    Jun 6, 2014 at 8:29
  • 1
    A. can be mitigated if you only ship what is really necessary. You must realize that most people will not upgrade it ever. "Check if they update the CAs." --- it's technically impossible (well, possible but inconvenient and looks like: "we won't do smart things but you will pay because we are lazy")
    – zerkms
    Jun 6, 2014 at 8:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .