6 ms·

For reference. I can’t actually find a list of Google’s right now. Mozilla: https://wiki.mozilla.org/CA/Included_Certificates https://wiki.mozilla.org/CA/Inclu

For reference. I can’t actually find a list of Google’s right now. Mozilla: https://wiki.mozilla.org/CA/Included_Certificates https://wiki.mozilla.org/CA/Included_Certificates EDIT: and yes, it would have been nice for the author to link directly to these... Google clearly has their own, but obviously there’s some debate about what that means.

gruez 6y ago
google's list seems to be here: https://android.googlesource.com/platform/system/ca-certificates/+/master/google/files https://android.googlesource.com/platform/system/ca-certific...
- saagarjha 6y ago
  Is that not Android's list? Or does Google ship those on all platforms it runs on?
mrkstu 6y ago
Chrome uses the OS level cert store, whereas Mozilla uses it's own.
- ocdtrekkie 6y ago
  This is configurable for both, I believe. It's common for enterprises to switch Firefox to use the OS store to support internal certificates.
  - mrkstu 6y ago
    You can easily import cert's into OS stores. I've actually rarely seen Firefox as a first option, more likely as a secondary option. You're likely going to need to manipulate the OS store regardless, so Firefox is just extra work.
    - pitaj 6y ago
      I think you misinterpreted his comment. He was saying Firefox by default uses its own store, so enterprises switch it to use the OS store when they need it to use internal certs.
      - mrkstu 6y ago
        Ah, that's probably the more reasonable interpretation, thanks.
      - tialaramex 6y ago
        Specifically Mozilla provides a flag which has the effect of accepting the additional corporate trust only. So e.g. if Microsoft decides for $1B cash they trust Honest Abe's Totally American For-Profit Church O'Certs and ships a Windows 10 update to enable that, Firefox still won't accept Abe's bogus google.com cert even with the enterprise mode on. But if your head of IT decides they'd very much like to issue certificates for internal-test-server.example and pushes a new root CA from their laptop via Group Policy, Firefox in enterprise mode will trust that cert because it was local policy. Basically the idea is Mozilla won't substitute Microsoft's decisions for their own, but your own local certificate policies are different. So you can opt into the latter in Firefox, but not the former.
  - mrkstu 6y ago
    Chrome on non-ChromeOS can't be configured with its own cert store. It just isn't there, though they keep a list of some black-listed root CAs. https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...
hda111 6y ago
What do you mean by Google? Google Chrome uses whatever the operating system provides. Nothing specific in Chrome. Firefox uses their own store.
- sleevi 6y ago
  Chrome on ChromeOS has had its own trust store for ages. Chrome on Android similarly uses Google’s Android store.
slezyr 6y ago
https://source.chromium.org/chromium/chromium/src/+/master:net/data/ssl/root_stores/root_stores.json?q=0C258A12A5674AEF25F28BA7DCFAECEEA348E541E6F5CC4EE63B71B361606AC3&ss=chromium%2Fchromium%2Fsrc https://source.chromium.org/chromium/chromium/src/+/master:n...
ehsankia 6y ago
Great podcast episode which discusses Mozilla/Google's CA lists, as well as the story of Gervase Markham (who recently passed) working on making the first fully open and transparent root program at Mozilla. https://darknetdiaries.com/transcript/3/ https://darknetdiaries.com/transcript/3/

gruez 6y ago

google's list seems to be here: https://android.googlesource.com/platform/system/ca-certificates/+/master/google/files https://android.googlesource.com/platform/system/ca-certific...

saagarjha 6y ago
Is that not Android's list? Or does Google ship those on all platforms it runs on?

mrkstu 6y ago

Chrome uses the OS level cert store, whereas Mozilla uses it's own.

ocdtrekkie 6y ago
This is configurable for both, I believe. It's common for enterprises to switch Firefox to use the OS store to support internal certificates.
- mrkstu 6y ago
  You can easily import cert's into OS stores. I've actually rarely seen Firefox as a first option, more likely as a secondary option. You're likely going to need to manipulate the OS store regardless, so Firefox is just extra work.
  - pitaj 6y ago
    I think you misinterpreted his comment. He was saying Firefox by default uses its own store, so enterprises switch it to use the OS store when they need it to use internal certs.
    - mrkstu 6y ago
      Ah, that's probably the more reasonable interpretation, thanks.
    - tialaramex 6y ago
      Specifically Mozilla provides a flag which has the effect of accepting the additional corporate trust only. So e.g. if Microsoft decides for $1B cash they trust Honest Abe's Totally American For-Profit Church O'Certs and ships a Windows 10 update to enable that, Firefox still won't accept Abe's bogus google.com cert even with the enterprise mode on. But if your head of IT decides they'd very much like to issue certificates for internal-test-server.example and pushes a new root CA from their laptop via Group Policy, Firefox in enterprise mode will trust that cert because it was local policy. Basically the idea is Mozilla won't substitute Microsoft's decisions for their own, but your own local certificate policies are different. So you can opt into the latter in Firefox, but not the former.
- mrkstu 6y ago
  Chrome on non-ChromeOS can't be configured with its own cert store. It just isn't there, though they keep a list of some black-listed root CAs. https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...

hda111 6y ago

What do you mean by Google? Google Chrome uses whatever the operating system provides. Nothing specific in Chrome. Firefox uses their own store.

sleevi 6y ago
Chrome on ChromeOS has had its own trust store for ages. Chrome on Android similarly uses Google’s Android store.

slezyr 6y ago

https://source.chromium.org/chromium/chromium/src/+/master:net/data/ssl/root_stores/root_stores.json?q=0C258A12A5674AEF25F28BA7DCFAECEEA348E541E6F5CC4EE63B71B361606AC3&ss=chromium%2Fchromium%2Fsrc https://source.chromium.org/chromium/chromium/src/+/master:n...

ehsankia 6y ago

Great podcast episode which discusses Mozilla/Google's CA lists, as well as the story of Gervase Markham (who recently passed) working on making the first fully open and transparent root program at Mozilla. https://darknetdiaries.com/transcript/3/ https://darknetdiaries.com/transcript/3/