Cybersecurity

Hey everyone, I'm trying to get a lay of the land for OS and Application Certificate Stores. Can someone confirm that I have this concept right?

If the application you're using say Firefox has it's own trusted CA store, it uses that exclusively. So if you're running firefox in Windows, Firefox will only check the validity of certificates on it's own store, and not ever reference the Microsoft Store.

As opposed to using internet explorer in Windows where it exclusively uses the Microsoft CA store.

This is something I'm unsure of, does iOS, Linux and Android provide a trusted suite of CA's? Where is it in the File system? It's my impression that these OS' use the SSL command suite to verify certificates? Or do these OS' offer no store, and just hope that the application is doing the checking of certificates?

For instance, right now I"m using google chrome in linux. When I go into the browser settings and advanced settings, to certificates, I get a list of trusted CA's. Where is this list coming from my Linux OS, or the browser itself?

Well, I can poke around on my own workstation and get answers that apply to it. Not sure about your setup. openSSL first... In /etc, I found my openssl.cnf file. It says:

Code:

dir             = ../../CA              # Where everything is kept
certs           = $dir/certs            # Where the issued certs are kept
crl_dir         = $dir/crl              # Where the issued crl are kept
database        = $dir/index.txt        # database index file.

So now I know where my openSSL certs are stored. Those directories are empty as I expected. I don't know anyone who actually uses openSSL. But openSSL has a magnificient crypto library. Everybody installs openSSL to get access to that library. It is a prerequisite to openSSH. This leads people to think that SSH uses SSL, but it doesn't. The openSSH guys just did not want to rewrite that crypto library.

Since my openSSH cert database is empty but my firefox can talk https, a reasonable guess is that firefox must use its own database. The docs say it is per user and stored under .mozilla somewhere in a file called cert8.db. It needs to get seeded with a list of trusted top-level guys. I don't know how firefox does that. I hope it calls home at profile creation time to get the most recent list from firefox.com.

A much more interesting question is how does someone become a trusted top level certificate authority? So for example, where Go-Daddy decided to get into the business, how do they get themselves added to the list? To phrase it another way, if I wrote a new browser, how would I get a definative list? (besides just copying a list from a pre-existing browser) If anyone knows, please post a followup.

My guess is that Chrome also keeps its own list.

Great explanation, thanks! Also from how I had it explained to me... when a new CA emerges, they sort of 'earn their spurs' by having other CA's sign their certs.

Is openssl and NSS the main to preferred methods to open an SSL connection?

Lastly, I know revocation checking is done with either a CRL check or the OCSP protocol, are these built into openssl or nss?

NSS is the name of the suite of protocols as far as I know. There may be some product or software that itself NSS but I don't know about it.

My feeling is that most SSL connections are opened by browsers and I do not believe that browsers use openssl in a direct sense. They may be based on openssl but I'm not sure about that.

I don't believe that revocation checking is built into openssl. Those trusted third parties charge money for their service and it is reasonable to expect them to handle revocations internally. You talk to the third party every time a connection is established. Expirations are another matter. The expiration date is built into the certificate. Your browser can point out expirations without asking the third party. What can the third party say except, "yep, expired alright."?

I pay attention to expirations. Most may be innocent, but web sites with a clue won't let their certificates expire.

You are of course correct - Firefox does indeed have its own OpenSSL CACertificate store, you can locate it's branch by doing a: ls -a and then going into the directory .(dot)firefox and then finding the CACert folder hidden deep within it's bowls like some kind of long lost and forelorn secret, inside is a certificate for the DoD. In wake of the spying revelations of late I would be guessing thats Fox-Acid! And of course Boundless Geo would be part of the Firefox Geo_IP Stack - Boundless Informant! Oh dear, what has Mozilla been up to? Time to expell all major Browsing Vendors that cant respect there users privacy rights. Sadly that looks like it includes MozDev!

Secure sockets, hahahahahahahahahahahahaha!~ No... Not unless you own all the Keys!

An that Right there is the Root (pun!) of the problem.

Correct me if I am wrong, but we get these Certificates issued by the likes of EQUIFAX & Wells Fargo because they are a part of the "Bank" and thusly part of the Federal Reserve that owns and controls a large portion of the worlds wealth, whilst being totally bust (no gold folks) and those certificates are issued by RSA and we accept the use of those Certificates on the Merit of Trust..

But as of Late, I dont think there's a single programmer around after the Dual Elliptic farce & heartbleed that still has a lot of trust in RSA and it should be clear to us all by now where advertising networks loyalties lay, is obviously with there Wallet!

We'd all be very hard pressed to miss what is so obviously stairing us all in the face not to mention, the leaked Documents on the ACLU Website clearly show Server to Server authentication whilst it's all happening.

The Fortune 500 has no Fortune, it's held together by Fraud & Lies - So they've now decended into petty thievery to try and make it all work in there favor whilst hidding behind the best Lawyers there ill gotten money can buy. There must have been something wrong with Mosaic the 16 Bit DEC Browser available in Windows 3.1 because it got upgraded to IE 32 Bit and Windows 95 with NSA_Key.dll