Hacker News Reader

Comment by chrismeller | Hacker News Reader

For reference. I can’t actually find a list of Google’s right now.

Mozilla: https://wiki.mozilla.org/CA/Included_Certificates

EDIT: and yes, it would have been nice for the author to link directly to these... Google clearly has their own, but obviously there’s some debate about what that means.

View on HN

Chrome uses the OS level cert store, whereas Mozilla uses it's own.

This is configurable for both, I believe. It's common for enterprises to switch Firefox to use the OS store to support internal certificates.

You can easily import cert's into OS stores. I've actually rarely seen Firefox as a first option, more likely as a secondary option.

You're likely going to need to manipulate the OS store regardless, so Firefox is just extra work.

I think you misinterpreted his comment. He was saying Firefox by default uses its own store, so enterprises switch it to use the OS store when they need it to use internal certs.

Ah, that's probably the more reasonable interpretation, thanks.

Specifically Mozilla provides a flag which has the effect of accepting the additional corporate trust only.

So e.g. if Microsoft decides for $1B cash they trust Honest Abe's Totally American For-Profit Church O'Certs and ships a Windows 10 update to enable that, Firefox still won't accept Abe's bogus google.com cert even with the enterprise mode on. But if your head of IT decides they'd very much like to issue certificates for internal-test-server.example and pushes a new root CA from their laptop via Group Policy, Firefox in enterprise mode will trust that cert because it was local policy.

Basically the idea is Mozilla won't substitute Microsoft's decisions for their own, but your own local certificate policies are different. So you can opt into the latter in Firefox, but not the former.

Chrome on non-ChromeOS can't be configured with its own cert store. It just isn't there, though they keep a list of some black-listed root CAs.

https://www.chromium.org/Home/chromium-security/root-ca-poli...

https://source.chromium.org/chromium/chromium/src/+/master:n...

Great podcast episode which discusses Mozilla/Google's CA lists, as well as the story of Gervase Markham (who recently passed) working on making the first fully open and transparent root program at Mozilla.

https://darknetdiaries.com/transcript/3/

What do you mean by Google? Google Chrome uses whatever the operating system provides. Nothing specific in Chrome. Firefox uses their own store.

Chrome on ChromeOS has had its own trust store for ages. Chrome on Android similarly uses Google’s Android store.

google's list seems to be here: https://android.googlesource.com/platform/system/ca-certific...

Is that not Android's list? Or does Google ship those on all platforms it runs on?

Reply on news.ycombinator.com