Take the 2-minute tour ×

For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser.

But what about for firefox and chrome?

And then, what about when you get a linux distribution? Isn't all "secure" SSL traffic on a linux computer theoretically insecure, if all the root certificates came pre-installed on an image that was downloaded insecurely?

I mean, unless, I suppose, they provide a checksum via SSL that you verify before you install the system, right?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

When software needs to use SSL/TLS, it commonly wants to use a list of Certificate Authorities. There may be software that simply always warns for every unknown certificate, but like you said, Firefox and Chrome have a list of CAs.

Where they get this list depends on the software. You can google this, you know.

  • Mozilla maintains an own list of CAs (for Firefox, Thunderbird, etc.)
  • Chrome uses the CA list from the operating system, or at least on Windows I read.
  • Opera maintains an own list of CAs it seems.
  • Safari uses the OS's list (Apple's on OS X and Microsoft's on Windows).

Then about your question regarding how this list is obtained: You are right, if the download was not verified to be secure (in a secure way), then all communications from thereon are inherently insecure. When you are downloading a Linux distribution and I replace your download with one that has an altered CA list, then yes, I could read all your HTTPS communications. It's probably much easier to just install malware though.

Note that a checksum alone is not the ultimate solution: the checksum must be obtained over a secure connection (e.g. https), or else that too can be altered.

It's funny: if you need to obtain the checksum over https, where did your current browser (or OS) get a CA list? Somewhere you always have to trust someone or something (such as the shop you bought Windows from), besides the trust that you put in CAs.

share|improve this answer
It is, indeed, funny... turtles all the way down! –  wwaawaw Nov 18 '12 at 7:30
add comment

Your Answer


