Disclaimer: I am new to SSL, find it a little confusing, and need an answer somewhat quickly.
I was told that there was a danger that my "keystore" might be corrupted, so I am trying to examine it and make sense of it. I'm using Arch Linux.
I see a lot of fun stuff in
/etc/ssl/certs (and I suppose question #1 is, "is this what the 'keystore' is?"), but that list became much more sensible when I passed it all through
readlink -f and removed duplicates. It looks like all my certificates are from
/usr/share/ca-certificates/. The bulk of them are in the
mozilla/ subdirectory, but there are other subdirectories like:
brazil.gov.br/ cacert.org/ debconf.org/ gouv.fr/ signet.pl/ spi-inc.org/
My main problem is that I don't know how to spot a suspicious certificate. Simply going to these sites seems counter-intuitive (i.e. they may have the same malware that potentially corrupted my keystore in the first place).
ca-certificates is a package installed by my package manager; could I just purge it and then reinstall? Is that safe to do?
The issue that prompted this investigation was an unrecognized VeriSign certificate. Specifically, I was given a signature with a certificate which I did not (but presumably should) have and trust.
I found this page on VeriSign's site that lists a whole bunch of certificates: http://www.verisign.com/support/roots.html ...and so I started to check the fingerprints of the certificates I have installed against those on the site.
for cert in /etc/ssl/certs/Veri[Ss]ign*; do printf "%s: " $cert openssl x509 -noout -in $cert -fingerprint done
The result: One doesn't match. Sounds like an important one, too: "VeriSign Class 1 Public Primary CA".
Complications: My package manager tells me that my existing certificates checksum okay. Furthermore, the fingerprint on the certificate I'm supposed to have matches neither the one I have nor the one listed on VeriSign's site.