root certificate : Java Glossary

Introduction

You need the latest and greatest root certificates from the various signing authorities installed in your cacerts. file and in your browser. With them you can validate the public keys of certificates issued by that authority. The easiest way to do that is to use the latest Java JRE and also go to your browser vendor site and get the latest version of your browser, which will naturally include the latest root certificates. Happily most browsers come with extensive lists of root certificates built-in. Every new version of the browser automatically updates the list. The Chinese refer to them as self-signed certificates. To an American programmer, a self-signed certificate refers to a phony code-signing certificate.

Why You need to Install Root Certificates

When a company such as Thawte or Verisign issues a digital certificate for SSL or code signing, they digitally sign it with their own master private key certificate. To verify that the certificates that they issue are valid, you need a copy of the issuing authority’s public key in your browser for SSL (or in your cacerts. file for signed Applets or Java Web Start). The process of installing these public keys is called downloading root certificates or installing certificate authorities.

Importing Code-Signing and SSL Root Certificates

With modern JRE (Java Runtime Environment) s, it is most important to get the JREs (Java Runtime Environments) updated with the recent root certs, then secondarily the browser.

Here is how I import code signing and SSL root certificates into all my cacerts files.

How to Import Root certificates Into Various Browsers

Often all you need do install a certificate is click the link and the root certificate will automatically install into your browser.

Usually you download the certificate then install it from disk, especially Java. Some vendors do not provide downloadable certificates. They just display the base64 contents. You must collect those ASCII (American Standard Code for Information Interchange) characters, prune them, and put them in an 8-bit file.

how to update root certificates in various browsers.

How To Update Root Signing Authority Certificates
Last revised/verified: 2008-01-23
Logo	Browser	What To Do
	Java	You download the root certificate then import it into both your JRE and JDK (Java Development Kit) with: Where "C:\temp\Thawte Code Signing CA.cer" is the name of the root certificate you are importing. The default password for cacerts. is changeit (changeme on the Mac).
	Chrome	Download the root certificate to hard disk. Click on the options icon in the upper right corner. Click Settings. Click Show Advanced Settings at the bottom. Under HTTPS/SSL click Manage Certificates. Click import. Follow your nose.
	Opera	Just click on the certificate reference to download and import it, or click File ⇒ Open. Alternatively, Click tools ⇒ preferences ⇒ advanced ⇒ security ⇒ manage certificates ⇒ import. To see what root certificates are installed Click tools ⇒ preferences ⇒ advanced ⇒ security ⇒ manage certificates.
	Firefox	Just click on the certificate reference to download and import it, or click File ⇒ Open. Alternatively, click Tools ⇒ Options ⇒ Advanced ⇒ Encryption ⇒ View Certificates ⇒ import .
	SeaMonkey	Just click on the certificate reference to download and import it, or click File ⇒ Open. Alternatively, click Edit ⇒ Preferences ⇒ Privacy & Security ⇒ Certificates ⇒ Manage Certificates ⇒ import .
	IE 11	Download the root certificate to hard disk. Click on the options gear icon in the upper right corner. Click Internet Options. Click Content. Certificates. Click import. Follow your nose.
	IE 7	Download each certificate, then click file ⇒ open. To see which root signing authority certificates are included click tools ⇒ Internet Options ⇒ Content ⇒ Trusted Root Certificate Authorities.
	IE 6	Download each certificate, then click file ⇒ open. To see which root signing authority certificates are included click tools ⇒ Internet Options ⇒ Content ⇒ Trusted Root Certificate Authorities.
	Safari	Click start ⇒ Control Panel ⇒ network ⇒ Internet Options ⇒ Content ⇒ Trusted Root Certificate Authorities ⇒ import .

Caveat

Modern certificates are 2048 bits. They use TLS (Transport Layer Security) 1.2 protocol. They use SHA-256 or SHA-386. SHA-1 (Secure Hash Algorithm 1) is completely obsolete.

Don’t use Firefox if you are trying to collect root certificates to import into Java. It refuses to download certs. It automatically imports them into Firefox.

Why Are There Intermediate Certificates?

Everything depends on keeping the private key of the root certificate completely secret. You want to lock it in a vault. If somebody buys a certificate, you would need to take the root certificate out of the vault to sign it. That would expose it. If you use an intermediate certificate, you can keep the root locked up. Why use multiple intermediate certificates? If one of the intermediates is compromised, only some of your customers are compromised. You can recover with less embarrassment.

Root Certificate Sources

Here is where you can get various root certificates. Some of the most common ones are not listed here, since they come built-in. To find out which roots you need to support a given SSL certificate, look at the certificate chain display that Chrome will give you. When I can’t find the root cert, have tried exporting it from the chain. However, when I try to use such a cert, I get a handshake alert: unrecognized_name

I composed the above table by first printing a list of certificates supported by Google Chrome. Then I used Google Chrome and Google to search for name-of-cert root certificates. Google Translate let me read pages from foreign countries. Sometimes I would read the debates about adding (or removing) a certificate to Windows or a browser. In there sometimes was the URL (Uniform Resource Locator) of the website. I never included copies of certificates in repositories. I have no way of knowing if they are valid. Repositories should always reference the original URL, not just serve a local copy unless the original no longer exists. I am not trying to track individual certificates, just the web pages where you can download the originals.

Built-in Certificates

You might wonder what determines which root certificates get factory-installed into which browsers. If you are a certificate-issuing company, you will have a heck of a time selling your certificates if the visitors to your site must first manually install a root certificate. They may not be technically competent. They may be unwilling to take the security risk.

Browser makers want to include as few certificates as possible because each one chews up RAM (Random Access Memory). They don’t want to include root certificates from fly-by-night or careless certificate issuers. That leaves their users vulnerable.

Certificate issuers want there to be large numbers of their root certificates pre-installed. If anyone is compromised, that limits the damage.

Large certificate issuers want the small competition squashed by being frozen out of the game.

Small certificate issuers want everyone included so they can compete on a level playing field.

End users just want to be able to read the websites, so they would be happiest if nearly all root certificates were pre-installed.

The situation is ripe for corruption. Certificate issuers have the temptation to offer bribes to get their roots in and their competitors excluded.

We as end users should be pressuring browser-makers to include/exclude worthy/unworthy roots. We as end users can always use a different browser with a different set of built-in roots.

RFE (Request For Enhancement)

It a huge amount of work to track down the root certificates associated with a certificate. I think the following should be embedded in every certificate:

• URLs (Uniform Resource Locators) of all the root and intermediate certificates needed to use this certificate.
• The URL describing the certificate for the potential purchaser.
• Root certificates file names should always exactly match the internal name.

Viewing Which Certificates Are Installed