How Makers of Web Browsers Include CAs in Their Products

How Makers of Web Browsers Include CAs in Their Products
Since Certificate Authorities (CAs) are on many people's minds nowadays, we asked @sans_isc followers on Twitter: How do browser makers (Microsoft, Mozilla, Google, Opera) decide which CAs to put into the product? Several individuals kindly provided us with pointers to the vendors' documentation that describe their processes for including CAs in web browser distributions: Microsoft describes its Root Certificate Program (thanks, @leftistqueer) Mozilla maintains a CA Certificate Inclusion Policy (thanks, @ypatiadotca and @rik24d) Apple documents the requirements for its Root Certificate Program (thanks, @GothAlice) Opera clarifies how to get a root certificate included in its browser (thanks, @Chasapple) If you have a pointer to Google Chrome certificate-inclusion practices, please let us know. -- Lenny Lenny Zeltser focuses on safeguarding customers' IT operations at Radiant Systems. He also teaches how to analyze and combat malware at SANS Institute. Lenny is active on Twitter and writes a daily security blog.	Lenny 216 Posts Sep 8th 2011
Thread locked Subscribe	Sep 8th 2011 9 years ago
There was this nice spoof recently: https://bugzilla.mozilla.org/show_bug.cgi?id=647959	otmar 3 Posts
Quote	Sep 8th 2011 9 years ago
We need to get all of the browsers to include Convergence to replace the broken CA system. http://convergence.io/	Richard 3 Posts
Quote	Sep 8th 2011 9 years ago
It seems Google Chrome uses the list of trusted CAs available on the underlying operating system, such as Microsoft or Apple. On Linux, Chromium uses the NSS Shared DB (https://code.google.com/p/chromium/wiki/LinuxCertManagement and http://wiki.cacert.org/FAQ/BrowserClients?action=show&redirect=BrowserClients#Linux).	Raul Siles 152 Posts
Quote	Sep 11th 2011 9 years ago