kirei / catt

Certification Authority Trust Tracker

Certification Authority Trust Tracker

What is CATT?

CATT (Certification Authority Trust Tracker) is a collection of scripts and data to track which certification authorities are trusted by various root CA programs.

Publishing Trusted Root Certificates

The CATT project urge root certificate program managers to publish the following information:

• All currently approved and trusted root certificates. The preferred publishing format is X.509 certificates encoded as PEM or DER, but other formats may be usable as well (e.g., Mozilla certdata as mentioned above). Note that publishing certificate fingerprints is not enough - we do need the actual certificate.

• All currently approved and trusted Extended Validation OIDs together with each corresponding issuing CA fingerprint.

We strongly recommend that the data above is published at a stable long-term URL, in order to be able to fetch the data automatically.

Trust Sources

Apple

• http://www.apple.com/certificateauthority/ca_program.html

Root certificates extracted using extract-osx-trust.sh and and split into files using split-bundle.pl. EV OIDs extracted using extract-osx-ev-pl.

• Root CA: /System/Library/Keychains/SystemRootCertificates.keychain
• EV status: /System/Library/Keychains/EVRoots.plist

Apple publish a list of trusted root certificates for iOS, but as this list does not include full certificate data (including public keys) it cannot be used by CATT.

Mozilla

• https://www.mozilla.org/projects/security/certs/policy/

Root certificates fetched using mk-ca-bundle.pl and split into files using split-bundle.pl. EV OIDs extracted using extract-mozilla-ev.py.

More information:

• Root CA: http://mxr.mozilla.org/mozilla-central/source/security/nss/lib/ckfw/builtins/certdata.txt
• EV status: https://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/src/nsIdentityChecking.cpp

Microsoft

• http://technet.microsoft.com/en-us/library/cc751157.aspx
• https://support.microsoft.com/kb/2677070

Root certificate metadata is fetched using fetch-microsoft-authroot.sh, producing a JSON file called authroot.json. Actual root certificates fetched using the contents of the JSON file by fetch-microsoft-certs.sh. EV OIDs are not yet extracted.

A ancient snapshot of trusted root certificates can also be found in xfiles/microsoft-2012-12.xlsx.

• http://social.technet.microsoft.com/wiki/contents/articles/3281.introduction-to-the-microsoft-root-certificate-program.aspx
• http://social.technet.microsoft.com/wiki/contents/articles/14215.windows-and-windows-phone-8-ssl-root-certificate-program-member-cas.aspx

Oracle Java SE

• http://www.oracle.com/technetwork/java/javase/javasecarootcertsprogram-1876540.html

Root certificates extracted from the Java keystore using extract-java-trust.pl.

catt's Issues

Mozilla EV tool not working

extract-mozilla-ev.py seems to be not functioning, could you please take a look?

Mozilla EV extraction broken

Could you fix extract-mozilla-ev.py? It seems Mozilla has moved vital parts.

Adobe Approved Trust List

Would you be open to a PR adding Adobe's root stores from Acrobat/Reader? Granted, the certificates are used for document signing/revocation/timestamping, and not web browsing. If this is within the scope of your project, I'd be happy to write the script for it.

I have started work on the script, and I have a working proof of concept thus far. Adobe Reader X pulls the certificate list from http://trustlist.adobe.com/tl10.acrobatsecuritysettings automatically. This file is a special PDF file, which is signed by Adobe. (using PDF signing mechanisms) There is one attachment in the PDF file, which is an XML file containing base64-encoded certificates, trust options, and other metadata.

readable CertFriendlyName names (remove \u0000)

Subject: parse-microsoft-authroot.pl

I am looking at the out put of fetch-microsoft-authroot.sh in authroot.json.
The CertFriendlyName looks like that:

"CertFriendlyName" : "C\u0000e\u0000r\u0000t\u0000p\u0000l\u0000u\u0000s\u0000 \u0000R\u0000o\u0000o\u0000t\u0000 \u0000C\u0000A\u0000 \u0000G\u00002\u0000\u0000"

Doing

grep CertFriendlyName authroot.json | sed 's/\\u0000//g'

produces something really "friendly" like:

"CertFriendlyName" : "Certplus Root CA G2"

I am sure that it's easy to get that into the perl script parse-microsoft-authroot.pl. Changing

-$CertFriendlyName =~ s/\x00$//g;
+$CertFriendlyName =~ s/\x00//g;

does the job for me. But it might break other things.

Microsoft script includes CA certs that don't have server-auth EKU

The script for fetching the Microsoft trust store takes all certificates including certs that do not have the server-auth EKU, ie. that are not meant to be used for issuing web server certs. This might be the intended behavior but I thought I'd let you know just in case.

iOS trust store ?

Is it the same as the OS X trust store ? There's an unusable list of CA certs here: http://support.apple.com/kb/ht5012 but I couldn't find more info.
README should provide some details about this (if you can figure it out :p)

Thanks!

Regular updates

Hi @kirei, thanks a lot for this compilation of truststores! We use it in https://github.com/mozilla/tls-observatory to evaluate certificate trust.
One thing I've been wondering about is the freshness of the data in this repo. The Mozilla CA, for example, is updated monthly upstream but I don't believe this is reflected here. What would it take to have weekly or monthly updates of this repository? Could it be automated somehow?

Provide visual CA dump diff

We need a script that compares to directories (certs and EV info) and produces a report on what has changed between them, preferably as markdown.

Opera no longer maintains a trust store

Most likely when switching to Blink, Opera stopped maintaining their own trust store:
http://www.opera.com/docs/ca/

The README should be updated in that sense.