1

Motivated by this and this question, I'd like to ask if there is a way to check if additional certificates have been maliciously added to the list of root CAs of Firefox. Possible ways could be:

  • an add-on/extension that reviews the list
  • a way to export all the trusted certificates from within Firefox, and an external program/website where I can upload the list and check it for extra ones.

I would run this verification both on my personal machine and on machines administered by others. I am well aware that a sysadmin could circumvent these checks by installing a recompiled version of Firefox, and that the root CA system is way beyond broken in many other ways, but at least it's a first step.

Improve this question
2
  • You forget the system admin can install any certificate they want. If you are not the admin even if you find a non-trust worthy certificate not much you can do about it
    – Ramhound
    Mar 27, 2014 at 9:39
  • @Ramhound Yes, I realize that they can install any certificate. I'd like a way to check if this has happened (even if it can be circumvented, but that requires more work and "raises the bar").
    – Federico Poloni
    Mar 27, 2014 at 9:50

1 Answer 1

Reset to default
0

You can use the Certutil utility to list all Non-Default Root Certificate Settings.

Its a commandline tool, read more about it here: Windows & Unix.

The instructions below on how to run it against your Firefox Certificate Database and it's other uses can be found here.

The section on the Mozilla Wiki says the following:

There is currently no UI to list all built-in root certificates for which you have overridden the default trust settings You can use the certutil tool to list all the certificates in your personal database, which includes built-in root certificates whose trust you have changed along with added root certificates and many other kinds of certificates.

Run this command (doing it while the Mozilla application is running is probably unsupported but does not seem to cause problems in practice):

certutil -d PROFILE_DIR -L

There is also a bug report to add the feature you are looking for:

Bug 545498 - Provide Capabilities to Detect and Manage Root Certificate Inconsistencies

In the meantime however, you could use the tool to extract your settings and compare your certificates against the list of CA certificates that are distributed with Mozilla software products, available in a spreadsheet or text file.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.