CA Trust Store

Verify CA trust store and root certificate status

Domain

Port

About

The CA Trust Store Lookup tool checks which root Certificate Authorities are trusted by major browsers and operating systems. It provides a comprehensive view of CA trust status across different platforms including Mozilla Firefox, Apple macOS/iOS, Microsoft Windows, and Android/Chrome. This helps you understand whether certificates issued by a specific CA will be trusted by your users across all platforms.

The tool also tracks CA trust store changes, including newly added CAs, removed CAs, and CAs with restricted trust. With the rise of distrust events (like Symantec, CNNIC, and StartCom), knowing which CAs are trusted by which platforms is critical for maintaining universal compatibility. Use this tool when evaluating a new CA or troubleshooting trust issues on specific platforms.

How to Use

1Enter a domain name to check which CA issued its certificate and verify trust status
2Or browse the full trust store to see all trusted CAs across platforms
3Filter by platform (Mozilla, Apple, Microsoft, Google) to see platform-specific trust status
4Review the detailed trust information including certificate fingerprints and trust constraints

Use Cases

•CA Evaluation: Before choosing a Certificate Authority, verify their root certificates are trusted by all major platforms your users operate on
•Distrust Event Monitoring: Stay informed when CAs are distrusted by browsers (like Symantec, WoSign) and identify affected certificates
•Cross-Platform Compatibility: Ensure certificates issued by your CA will be trusted on Windows, macOS, iOS, Android, and Linux systems
•Enterprise Trust Management: Manage custom trust stores for enterprise environments where standard trust stores are modified
•Compliance Documentation: Generate reports showing CA trust status for security audits and compliance requirements

What The Store Contains

Trust is decided by comparing a chain against a set of roots. This page reports what is in the store this machine uses and where a certificate sits relative to it.

1Load the available trust bundles and count how many roots they contain, so you can tell an empty result caused by a missing bundle from one caused by an untrusted authority.
2Identify the authority for the host checked and report whether it appears among the roots in the store — matching self-signed roots only, since matching the intermediate that issued the certificate would flag nearly every real authority as untrusted.
3Explain that an intermediate being absent is normal. Intermediates are trusted through their root rather than directly, which is the design. Whether the chain from the leaf to a root is intact is a separate question the chain checker answers.

This store is not any browser's, though it draws from similar root programmes. A positive result is good evidence of widespread trust; a negative one is worth confirming in a browser before acting on it.

Tips & Best Practices

•Always verify CA trust across all platforms before deploying certificates in production
•Monitor CA distrust announcements and check your certificates against the updated trust stores
•When using private or internal CAs, ensure they are added to all endpoint trust stores
•Consider using CAs with cross-signed roots for maximum compatibility across older and newer platforms

Technical Details

●Trust Stores: Maintains up-to-date trust stores from Mozilla NSS, Apple Security, Microsoft Root Program, and Google Chrome

●Distrust Tracking: Records historical distrust events with dates, reasons, and affected certificate ranges

●Cross-Signing: Identifies cross-signed certificates and their trust paths through multiple root CAs

●Constraint Analysis: Reports nameConstraints, pathLenConstraints, and other trust-limiting extensions

Frequently Asked Questions

Different browser and OS vendors maintain their own root certificate trust stores and have different policies for adding, removing, or restricting CAs. A certificate issued by a CA trusted by Mozilla but not yet approved by Microsoft will work in Firefox but show trust errors in Edge/IE. This is why checking cross-platform trust is essential.

Trust store updates happen frequently — Mozilla updates monthly, Apple and Microsoft quarterly, and Google with Chrome releases. Major changes like CA distrust events can happen suddenly. Our tool tracks these changes and alerts you when certificates from CAs you use are affected.

If your CA is distrusted on a platform, you need to replace certificates with one from a trusted CA before the distrust takes effect. Most distrust events have a grace period. Plan migration to an alternative CA immediately and test certificate deployment across all affected platforms.

No, though they draw from the same root programmes. This uses the certificate bundles available on the server, which is a good proxy for what mainstream browsers accept but not identical to any one browser's store. Roots are added and removed by the programmes on their own schedules, and different products update at different times. Treat agreement as strong evidence and disagreement as worth a second opinion.

Because that is correct behaviour. Roots are the anchors and intermediates are delegated from them, so an intermediate is trusted through its path to a root rather than by appearing directly. A store listing intermediates as trust anchors would be unusual. What matters is whether that path is complete, which is exactly what the chain checker verifies.

Roughly a hundred and fifty, having grown over the years as more authorities have been admitted. The count varies by product and by date, so treat any specific number as approximate. A very low count here suggests a bundle failed to load rather than that the store is unusually strict, which is why the count is reported alongside the classification.

Yes — that is what a private CA is for. Adding the root to the systems that need to trust it makes internal certificates validate without weakening anything globally. The security consequence is concentrated: whoever holds that root can issue certificates your systems will accept, so protect it accordingly and scope its distribution to what genuinely needs it.

That no path from this certificate to a root in the local store was found, which has several possible causes beyond a genuinely untrusted authority — a private CA, an incomplete chain, a newer authority, or simply a store difference. Establish which before concluding anything, since the remedy differs completely in each case: fixing a chain is a server change, while an untrusted authority would be a policy decision.