22

On Fedora, I'm talking about the list displayed when you go to settings > manage certificates > authorities tab.

I've read that it should be in the NSS shared DB, but this command returns an empty list:

[laurent@localhost nssdb]$ certutil -d sql:$HOME/.pki/nssdb -L
13

Those are NSS built-in certificates. They are provided through a shared library: /usr/lib/libnssckbi.so (path may be different on your system). That's where Chrome gets them from.
You could list them with certutil like this:

Make a link to the library in ~/.pki/nssdb:

ln -s /usr/lib/libnssckbi.so ~/.pki/nssdb

Then run:

certutil -L -d sql:$HOME/.pki/nssdb/ -h 'Builtin Object Token'

Output:

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Builtin Object Token:GTE CyberTrust Global Root              C,C,C
Builtin Object Token:Thawte Server CA                        C,,C 
Builtin Object Token:Thawte Premium Server CA                C,,C 
Builtin Object Token:Equifax Secure CA                       C,C,C
Builtin Object Token:Digital Signature Trust Co. Global CA 1 C,C,C
Builtin Object Token:Digital Signature Trust Co. Global CA 3 C,C,C
Builtin Object Token:Verisign Class 3 Public Primary Certification Authority C,C,C
Builtin Object Token:Verisign Class 1 Public Primary Certification Authority - G2 ,C,  
Builtin Object Token:Verisign Class 2 Public Primary Certification Authority - G2 ,C,C 
Builtin Object Token:Verisign Class 3 Public Primary Certification Authority - G2 C,C,C
Builtin Object Token:GlobalSign Root CA                      C,C,C
Builtin Object Token:GlobalSign Root CA - R2                 C,C,C
Builtin Object Token:ValiCert Class 1 VA                     C,C,C
Builtin Object Token:ValiCert Class 2 VA                     C,C,C
Builtin Object Token:RSA Root Certificate 1                  C,C,C
..................................................................
..................................................................
| improve this answer | |
  • And if I want to add a certificate to Chrome's trusted store using certutil, How can I? certutil -d sql:$home/.pki/nssdb -A -n 'certificate name' -i filename.cer -t "CT,," adds the cert into the nss db, but Chrome and Firefox don't see/trust the new cert. – ndemarco Mar 3 at 4:06
  • @ndemarco - your command looks good to me, no idea why it doesn't work. – don_crissti Mar 3 at 10:42
9

It get's them from the underlying operating system. You can read about it here:

excerpt from above link

Google Chrome attempts to use the root certificate store of the underlying operating system to determine whether an SSL certificate presented by a site is indeed trustworthy, with a few exceptions.

That page goes on to describe who to contact if you're a root CA provider for the various OSes etc.

References

| improve this answer | |
3

In the off chance that you're asking because you actually need to use the list of root CAs, here they are (unfortunately named only by index):

Individual Certificate Files

https://github.com/coolaj86/node-ssl-root-cas/tree/master/pems

Mozilla's Big File of Certificates

http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1

Scripts to Parse the Big File of Certificates

https://github.com/coolaj86/node-ssl-root-cas

https://github.com/bagder/curl/blob/master/lib/mk-ca-bundle.pl

http://curl.haxx.se/docs/mk-ca-bundle.html

General Information about extracting Mozilla's Certificates File

http://curl.haxx.se/docs/caextract.html

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.