25

On Fedora, I'm talking about the list displayed when you go to settings > manage certificates > authorities tab.

I've read that it should be in the NSS shared DB, but this command returns an empty list:

[laurent@localhost nssdb]$ certutil -d sql:$HOME/.pki/nssdb -L

4 Answers 4

16

Those are NSS built-in certificates. They are provided through a shared library: /usr/lib/libnssckbi.so (path may be different on your system). That's where Chrome gets them from.
You could list them with certutil like this:

Make a link to the library in ~/.pki/nssdb:

ln -s /usr/lib/libnssckbi.so ~/.pki/nssdb

Then run:

certutil -L -d sql:$HOME/.pki/nssdb/ -h 'Builtin Object Token'

Output:

Certificate Nickname                                         Trust Attributes
                                                             SSL,S/MIME,JAR/XPI

Builtin Object Token:GTE CyberTrust Global Root              C,C,C
Builtin Object Token:Thawte Server CA                        C,,C 
Builtin Object Token:Thawte Premium Server CA                C,,C 
Builtin Object Token:Equifax Secure CA                       C,C,C
Builtin Object Token:Digital Signature Trust Co. Global CA 1 C,C,C
Builtin Object Token:Digital Signature Trust Co. Global CA 3 C,C,C
Builtin Object Token:Verisign Class 3 Public Primary Certification Authority C,C,C
Builtin Object Token:Verisign Class 1 Public Primary Certification Authority - G2 ,C,  
Builtin Object Token:Verisign Class 2 Public Primary Certification Authority - G2 ,C,C 
Builtin Object Token:Verisign Class 3 Public Primary Certification Authority - G2 C,C,C
Builtin Object Token:GlobalSign Root CA                      C,C,C
Builtin Object Token:GlobalSign Root CA - R2                 C,C,C
Builtin Object Token:ValiCert Class 1 VA                     C,C,C
Builtin Object Token:ValiCert Class 2 VA                     C,C,C
Builtin Object Token:RSA Root Certificate 1                  C,C,C
..................................................................
..................................................................
2
  • 1
    And if I want to add a certificate to Chrome's trusted store using certutil, How can I? certutil -d sql:$home/.pki/nssdb -A -n 'certificate name' -i filename.cer -t "CT,," adds the cert into the nss db, but Chrome and Firefox don't see/trust the new cert.
    – ndemarco
    Mar 3, 2020 at 4:06
  • @ndemarco - your command looks good to me, no idea why it doesn't work. Mar 3, 2020 at 10:42
9

It get's them from the underlying operating system. You can read about it here:

excerpt from above link

Google Chrome attempts to use the root certificate store of the underlying operating system to determine whether an SSL certificate presented by a site is indeed trustworthy, with a few exceptions.

That page goes on to describe who to contact if you're a root CA provider for the various OSes etc.

References

1
  • It seems like this has changed in version 1.4 of the policy at the link above (Root Certificate Policy 1.4) "Chrome began a platform-by-platform transition from relying on the host operating system’s Root Store to its own on Windows, macOS, ChromeOS, Linux, and Android."
    – tjb
    Mar 27, 2023 at 9:27
3

In the off chance that you're asking because you actually need to use the list of root CAs, here they are (unfortunately named only by index):

Individual Certificate Files

https://github.com/coolaj86/node-ssl-root-cas/tree/master/pems

Mozilla's Big File of Certificates

http://mxr.mozilla.org/mozilla/source/security/nss/lib/ckfw/builtins/certdata.txt?raw=1

Scripts to Parse the Big File of Certificates

https://github.com/coolaj86/node-ssl-root-cas

https://github.com/bagder/curl/blob/master/lib/mk-ca-bundle.pl

http://curl.haxx.se/docs/mk-ca-bundle.html

General Information about extracting Mozilla's Certificates File

http://curl.haxx.se/docs/caextract.html

1

Looks like this has changed in Chrome 107 as Google bring in their own "Chrome Root Store"

https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md

https://support.google.com/chrome/a/answer/7679408#certVerifRem107

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .