2

I need to choose a certification authority (CA), to get a certificate, but I noticed that there are several of these only present in some operating systems/platforms like windows. I need to choose one that is present also in Linux (the more distributions the best) and mac.

Is there such a list/resoucer?

2

On Windows, CA are normally centralized in the OS, in the "trusted CA" store. Microsoft manages the default contents for this store, and they do this following an explicit "management program". You can find the list of CA there.

Apple also runs a similar program and documents the list of root CA that a brand new OS X will trust by default. Of course, any user is free to alter the list, although most users will keep the defaults.

However, any browser is free to use the OS list, or to use its own. On Windows, Chrome and IE will follow the OS-provided list; on OS X, Safari and Chrome will also follow the OS-provided list. Firefox, on the other hand, has its own list (and, indeed, its own SSL implementation). The list of root CA included by default in Firefox is available on this page. That list applies to all platforms on which Firefox runs.

On Linux, there is no real OS-provided list of trusted certificates (well, there are root CA certificates in /etc/ssl/certs/, but it is unclear whether they are actually "trusted", or simply "known", or which applications use these CA). In any case, Firefox on Linux still follows its internal list; Chromium (on Linux) is documented to use Firefox's list (specifically, to use the same default list as Firefox; local changes to Firefox don't impact Chromium, nor vice versa).

It seems that the Opera Web browser now uses Firefox's list (it relies on the NSS library which handles SSL for Firefox), so it should be considered similar to Firefox (in that respect) on all platforms.


So, for good interoperability, you should choose a CA which is on the lists from Microsoft, Apple, and Mozilla/Firefox. A root CA listed on all three lists will be recognized automatically by the overwhelming majority of users.

I am not aware of any maintained page anywhere which would aggregate these separate lists into a synthetic view. The operational word here is "maintained".

A further complication is that there are two kinds of root CA: the "normal" CA, and the "EV-Qualified" CA. The latter claim to be more thorough in their identity verification; the practical consequences is that their certificates are more expensive, and the padlock icon will be green (or similarly "highlighted") instead of grey. This distinction has attracted some criticism; e.g. Peter Gutmann states that the EV certificates are a trick to raise certificate prices with little security benefit since they don't solve a security issue which really existed in the first place. Yet they exist. If you want the green padlock, you'll need a root CA which is recognized as "EV-Qualified" by the major browsers. You can start with the list from the Wikipedia page.

0

I see from the tag that you mention Java. The technology you use makes a big difference in what certificate stores come into question. As Thomas says it's a whole different ball game for web browsers.

If you are focusing on Sun / Oracle Java deployment you should be getting the same cabundle file. That being said you should be able to pick one off that list.

  • I am usign java, and I know this platform also has it's own set. – nsn Jun 20 '14 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.