Problem - Kevin Tafuro

10.3 Using Root Certificates
Problem
You want to do certificate validation, but you need the correct certificates from the
certification authorities you intend to support.
Solution
The certificates that you need can be obtained from the authority themselves, but
unfortunately, many CAs do not make them easy to get. OpenSSLincludes several of
the more common root CA certificates, but it is not a complete collection. Popular
web browsers such as Internet Explorer for Windows also allow you to export the
certificates they contain.
A much more in-depth survey of all the common root certificates (particularly the
ones found in Microsoft’s Internet Explorer) is available in the Root Report, available
for sale from the PKI Laboratory (http://www.pkiclue.com).
Discussion
You should either obtain certificates directly from the CA over a
trusted medium or check the fingerprints of certificates you find on
the net or in your browser against fingerprints published in a trusted
source. You can do this by calling the CA, or you can compare against
the fingerprints published in this book.
Table 10-1 lists information about the root certificates for several prominent CAs.
The information was collected from Internet Explorer for Windows, but it contains
only those CAs that also publish CRLs. You can download these certificates (in PEM
format) from the book’s web site, but be sure to check the fingerprint of the certificate
against the fingerprint listed in this book. To check the fingerprint using the
OpenSSL command-line tool, use the command:
openssl x509 -fingerprint -noout -in cert.pem
where cert.pem is the name of the file containing the certificate that you wish to
check.
Note that most CAs have multiple certificates, so you should figure out what type of
certificate is right for your application. Generally, CAs will have at least one type of
certificate intended for secure servers. They may also have “personal” certificates for
user identification and even multiple types of personal certificates. Be sure to check
the description to figure out which certificates are relevant to your application.
Because most certificates eventually expire, there may be multiple root certificates of
the same type from the same CA at one time. For example, for a few years, VeriSign
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.
Using Root Certificates | 519