Trusted Root Certificate Authority (CA)

The Trusted root certificate authority (CA) refers to a certificate usually pre-installed in a special folder on most of the operating systems, browsers and devices. This pre-known certificate allows a user's device to trust the certificates from (and identity of) individuals, organizations, and computer systems. The CA usually refers to a third-party organization but many organizations host private CAs on their internal network.

Digital certificates

A digital certificate is an electronic "ID card" that is issued by a certification authority (CA) and contains information that uniquely identifies the holder, such as their name and address, as well as the digital signature of the CA. A digital certificate typically contains two types of keys: a public key and a private key. The public key is used to encrypt data and verify digital signatures, while the private key is used to decrypt data and create digital signatures. Together, these keys form a key pair, which is used to secure communications and authenticate the identity of the certificate holder. For example, when viewing this page, the website presented to the users device a certificate signed by the "Go Daddy Secure Certificate Authority - G2" which one can verify by clicking the lock icon and locating the certificate path information. One can also find a certificate from this CA pre-installed in the trusted root folder on one's device.

Trusted Root CA Folder

There are several risks associated with having only one CA in the trusted root folder of a PC:

1. Single point of failure: Having only one CA in the trusted root folder can create a single point of failure. If that CA is compromised or becomes unavailable, the PC may be unable to establish secure connections with any servers or services that rely on that CA.
2. Lack of flexibility: Having only one CA in the trusted root folder can limit a PC's ability to establish secure connections with a variety of different servers and services. This can be particularly problematic if the CA is not trusted by all organizations or industries.
3. Increased vulnerability to attack: Having only one CA in the trusted root folder can increase the potential attack surface of the PC's trust infrastructure. An attacker may be able to compromise the CA and use it to issue fraudulent certificates, which the PC would then trust. "If the root CA were to be compromised, an attacker could gain control of the entire PKI and compromise trust in the entire system, including any sub-systems reliant on the PKI. It is considerably more difficult to replace a root CA compared to an Intermediate CA."
4. Limited support for legacy systems: Having only one CA in the trusted root folder may limit the ability to support legacy systems or specific functionalities.
5. Dependence on single vendor: Having only one CA in the trusted root folder means that the PC is dependent on a single vendor for the maintenance and updates of the trusted CA. If that vendor goes out of business or loses its accreditation it can lead to trust issues.

Overall, having only one CA in the trusted root folder of a PC can create a single point of failure, limit flexibility, increase the potential attack surface, and limit the support for legacy systems. It also puts the trust of the PC on a single vendor which may not be reliable in the long term.

Examples of CA's being compromised before 2021

1. In 2011, the DigiNotar certificate authority (CA) was compromised, resulting in the issuance of rogue digital certificates for several high-profile domains. This incident highlighted the importance of diversity in the trust infrastructure, as relying on a single CA left the organization vulnerable to attack.
2. In 2011, the Comodo certificate authority (CA) was targeted by a phishing attack, which resulted in the issuance of rogue digital certificates for several high-profile domains, such as Google, Skype, Yahoo and others. The attacker was able to obtain the private key of the certificate authority, which allowed them to issue fake certificates. This incident highlighted the importance of proper security controls and diversifying the trust infrastructure. Relying on a single CA left the organization vulnerable to attack, as the attacker was able to use the compromised CA to issue fake certificates that were trusted by web browsers and other clients. This incident prompted the industry to review their practices and move towards a more robust trust infrastructure, with multiple CAs in place to reduce the risk of a similar attack occurring.

Distribution/installation of root CA certificates

Root certificates are typically distributed through a variety of methods, including:

1. Operating System or Browser Distribution: Many operating systems and web browsers come pre-installed with a set of root certificates from trusted certificate authorities. These root certificates are automatically updated as part of regular software updates.
2. Manually Installed: Some organizations may choose to manually install root certificates on their systems and devices. This is often done for custom or internal certificate authorities that are not included in the default set of trusted root certificates.
3. Active Directory: Some organizations may use Active Directory to distribute root certificates to their systems and devices. This allows for central management of the root certificates and can make it easier to ensure that all systems and devices have the correct set of root certificates installed.
4. Public Websites: Some certificate authorities make their root certificates available for download on their public websites. These root certificates can be manually downloaded and installed on systems and devices.
5. Network Devices: In some cases, root certificates may be distributed through network devices such as routers, firewalls, or VPN gateways. This can be done through firmware updates or by manually configuring the device to trust the appropriate root certificates.

Overall, the distribution method will depend on the organization's security policies and infrastructure. The goal is to ensure that all systems and devices have access to the correct set of root certificates in order to establish trust for secure communication.