Carleton University - School of Computer Science Honours Project
Fall 2020
Study on Root Certificate Stores
Jegan Purushothaman
SCS Honours Project Image
ABSTRACT
This project is a study on root certificate stores. The aim of the study is to determine whether differences in the root certificate stores included within several browsers and operating systems have an impact on a user’s interaction with the web. To do so, data pertaining to the root certificate stores used in software products made by Apple, Microsoft, Mozilla, Ubuntu and Google were collected, analyzed and compared to determine trust overlaps and disparities. Existing disparities were investigated and measurements to determine its impacts were conducted. The study found overlaps between several root certificate stores and significant disparities between Microsoft and other organizations in terms of the root certificates included. Microsoft had the highest number of certificates present in their store, many of which were not found with other root certificate stores. Our investigation found that many of these certificates were issued by enterprises and government affiliated organizations with some certificates intended for usages outside authenticating websites. A methodology towards identifying certificates issued by governments and organizations with close ties to governments was also established within the investigation. Three possible methods of measuring the impacts of these trust disparities were looked into, one of which facilitated the development of a solution which integrated the Selenium testing framework, Firefox Web Extensions and Python to provide a fully automated certificate collection tool which can be used for small-scale data collection efforts. Ultimately the Censys certificate engine was used instead due to its large dataset and aggregate data. Using a dataset of 500 million currently valid TLS certificates it was determined that 99% of certificates would be validated by the root certificate stores evaluated. Thus, the study has found that differences in root certificate stores have a negligible impact to users.