3 ms·
Where do low level (eg Android platform) devs pull root certificates from? Who governs that list?
by Traubenfuchs 3y ago
Where do low level (eg Android platform) devs pull root certificates from? Who governs that list?
- ZiiS 3y agoAndroid itself (I.e. Google) maintain thier own list; they manage it well IMHO but made a catastrofically bad desision to never update it outside OS versions (they have fixed this in the next release).
- tialaramex 3y agoIn principle whoever is building the Android system can choose whatever roots they want. In practice the Android Project is a Google project, and follows Google's policies. Also in practice, Google's policies strongly resemble Mozilla's. Mozilla's root programme is overseen by mozilla.dev.security.policy, a public group. So, to some extent the answer to "Who governs that list?" is you do, much as (if you live in a democracy) it's your fault that your government is terrible. You could work hard to improve things. But, you probably won't.