4
$\begingroup$

i understand that the purpose of root certificates and CA's is to ensure that the communication parties are who they say they are.

But how is the root certificate acquired? Is it not possible that during the acquisition someone is pretending to be the CA and i get a fake root certificate?

Thanks!

Improve this question
$\endgroup$

1 Answer 1

Reset to default
3
$\begingroup$

You are correct that getting the root certificate to the end user is a problem. There are two usual ways to solve this:

  1. Out of Band: The root cert is carried by USB stick, or is placed on the system during install, or is pushed by an IT management tool, or by some other non-internet method.

  2. Certificate Pinning: As an example, Firefox includes in its source code the root certs of all the publicly trusted SSL CAs. When you connect to an HTTPS site, Firefox checks that the root issuing cert matches one of the ~50 that are hard-coded into its source code. If Firefox wants to add / remove / modify one of the pinned root certs, it has to push a security patch to everyone. Since the binaries for Firefox are signed, it is difficult (though I'm sure not impossible) to plant a fake root cert in the list.

Improve this answer
$\endgroup$
4
  • 1
    $\begingroup$ Thanks for the reply. How are the firefox binaries signed? By some root cert again via a CA? Seems like and endless loop. Does some initial root certificate come with windows? $\endgroup$
    – ele lont
    Feb 10, 2016 at 14:47
  • $\begingroup$ This is becoming a different question, you would have to look into how the Windows Code Signing system works - I believe the OS ships with an initial set of trusted root certs. Also, IE has a set of trusted roots out-of-the-box, and you downloaded Firefox over HTTPS, right? Right? $\endgroup$
    – Mike Ounsworth
    Feb 10, 2016 at 14:54
  • $\begingroup$ @Mike modern Windows (which IE/Edge and Chrome use) fetches new roots from MS when needed, see security.stackexchange.com/questions/108951/… and security.stackexchange.com/questions/81491/… $\endgroup$
    – dave_thompson_085
    Feb 11, 2016 at 21:23
  • $\begingroup$ Thanks for the links. Yuck, that's sorta terrifying that M$ updates my root certs without telling me. I guess that's just one more bit of control over "your" machine that you have to shrug off when you use Windows. $\endgroup$
    – Mike Ounsworth
    Feb 11, 2016 at 21:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.