{"id":15874878,"url":"https://github.com/pgporada/ct-trusted-roots","last_synced_at":"2026-05-09T00:07:38.669Z","repository":{"id":149290418,"uuid":"192835466","full_name":"pgporada/ct-trusted-roots","owner":"pgporada","description":"Allows an operator to acquire trusted root certificates from the various root programs","archived":false,"fork":false,"pushed_at":"2019-06-20T03:19:16.000Z","size":4,"stargazers_count":3,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"master","last_synced_at":"2025-04-05T08:42:30.012Z","etag":null,"topics":["apple","certificate-transparency","certificate-transparency-logs","chromium","mozilla","powershell","tls-certificate","windows"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pgporada.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-06-20T02:35:19.000Z","updated_at":"2025-01-23T01:27:02.000Z","dependencies_parsed_at":"2023-09-13T10:33:10.910Z","dependency_job_id":null,"html_url":"https://github.com/pgporada/ct-trusted-roots","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/pgporada/ct-trusted-roots","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pgporada%2Fct-trusted-roots","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pgporada%2Fct-trusted-roots/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pgporada%2Fct-trusted-roots/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pgporada%2Fct-trusted-roots/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pgporada","download_url":"https://codeload.github.com/pgporada/ct-trusted-roots/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pgporada%2Fct-trusted-roots/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32802550,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-08T08:22:46.396Z","status":"ssl_error","status_checked_at":"2026-05-08T08:22:45.650Z","response_time":54,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["apple","certificate-transparency","certificate-transparency-logs","chromium","mozilla","powershell","tls-certificate","windows"],"created_at":"2024-10-06T01:41:44.410Z","updated_at":"2026-05-09T00:07:38.654Z","avatar_url":"https://github.com/pgporada.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Overview\n\n[CT](http://www.certificate-transparency.org/what-is-ct) [log operators](https://www.youtube.com/watch?v=v39VIqULPzA) must maintain a list of certificates that the log will accept submissions from - the accepted roots list. This project will hopefully help _someone_ gather these certs for their log. For an easier to use project, [see this one](https://github.com/PeculiarVentures/tl-create/).\n\n- - - -\n# Known CT log programs\n\n* [Apple](https://support.apple.com/en-om/HT209255)\n* [Chromium](https://github.com/chromium/ct-policy)\n\n- - - -\n# Acquire certificates\n\n### Let's Encrypt Staging Environment Intermediate\n\n```\nwget https://letsencrypt.org/certs/fakeleintermediatex1.pem\n```\n\n### Google Maximum Merge Delay (MMD) monitor\n\n```\nwget https://raw.githubusercontent.com/chromium/ct-policy/master/mmd_monitor_root.crt\n```\n\n### Mozilla NSS\n\n[https://curl.haxx.se/docs/caextract.html](https://curl.haxx.se/docs/caextract.html)\n\n```\ncurl --remote-name --time-cond cacert.pem https://curl.haxx.se/ca/cacert.pem\nsed -n '/-BEGIN CERTIFICATE/,/-END CERTIFICATE-/p' cacert.pem \u003e mozilla-root-store.bundle\n```\n\n### Apple\n\nApple does not make it easy on the log operator by providing a certificate bundle. We'll be building this certificate bundle ourselves. Download the HTML which contains fingerprints of all the certificates that Apple requires the CT log to allow submssions from. We'll be comparing the fingerprints to what we extract from an OSX root store just to be sure.\n\nOn an up to date OSX device, open the Keychain app and drag all the system root certificates into a folder. This will export them all as individual files in DER format\nCompress the certs and transfer them to a Qubes VM\n```\nunzip apple-certs.zip\n```\n\nCompare the fingerprints that Apple lists at\nIf something is jacked up, try `export IFS=$'\\n'`\n```\nfind -type f -name '*.cer' -exec openssl x509 -inform der -in '{}' -noout -fingerprint -sha256 \\; | sed -e 's/SHA256 Fingerprint=//g' -e 's/:/ /g' \u003e fingerprints.txt\nfor i in $(cat fingerprint.txt); do grep \"${i}\" ../apple-trusted-list.html \u003e /dev/null ; if [ $? -ne 0 ]; then echo \"Fingerprint ${i} was not found in the trusted list. Remove this certificate.\"; fi; done\n```\n\nTo find any certificates that the previous command complained about (if any)\n```\nfind -type f -name '*.cer' -print -exec openssl x509 -inform der -in '{}' -noout -fingerprint -sha256 \\; | sed -e 's/SHA256 Fingerprint=//g' -e 's/:/ /g' | less\n```\n\nRemove any certificate that isn't found in the trusted list\n```\nrm -f whatever.cer\n```\n\nConvert the DER formatted certs to PEM\n```\nfind -type f -name '*.cer' -exec openssl x509 -inform der -in '{}' -outform pem -out '{}.pem' \\;\n```\n\nBundle all the Apple trusted root certs\n```\ncat *.cer.pem \u003e apple-trusted-roots.bundle\n```\n\n### Windows\n\nRun the powershell script located in `windows` on an up to date Windows server. After that, zip the certs up, transfer them to your Linux box, and finally continue processing them. You'll end up with ~395 (as of this writing) PEM formatted certs.\n```\nunzip windows-certs.zip\nmkdir -p windows-certs\ncd windows-certs\nfor i in *.der; do openssl x509 -inform der -in ${i} -outform pem -out ${i%%.*}.pem; done\nrm -f *.der\n```\n\n- - - -\n# Generate the accepted roots file\n\nCombine all the disparate files into a single file\n```\ncat mmd_monitor_root.crt mozilla-root-store.bundle apple-trusted-roots.bundle windows-certs/*.pem \u003e accepted-roots.pem\n```\n\nGet the [c_rehash](http://manpages.ubuntu.com/manpages/trusty/man1/c_rehash.1ssl.html) utility\n```\nsudo dnf install -y openssl-perl\n```\n\n```\nmkdir certs\ncp accepted-roots.pem certs/\ncd certs\nawk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print \u003e \"cert.\" c \".pem\"}' \u003c accepted-roots.pem\nc_rehash -v .\ncat *.[0-9] \u003e final-accepted-roots.pem\n```\n\nGather information about the unique certs\n```\nls -al *.[0-9] | wc -l\nfind . -type l -name '*\\.[0-9]' -exec openssl x509 -in {} -noout -subject -fingerprint -sha256 \\;\n```\n\n- - - -\n# Get root list from another log\nThis part has some extra handling due to https://github.com/openssl/openssl/issues/9187\n```\nfor cert in $(curl -s \"https://testflume.ct.letsencrypt.org/2019/ct/v1/get-roots\" | jq -r '.certificates | .[]' | sort | uniq); do echo -e \"-----BEGIN CERTIFICATE-----\\n${cert}\\n-----END CERTIFICATE-----\" \u003e\u003e accepted-roots.pem; done\nfold --spaces --width=64 accepted-roots.pem \u003e accepted-roots.folded.pem\nmv accepted-roots.folded.pem accepted-roots.pem\nawk 'BEGIN {c=0;} /BEGIN CERT/{c++} { print \u003e \"cert.\" c \".pem\"}' \u003c accepted-roots.pem\nfor cert in cert*.pem; do openssl x509 -in ${i} -noout -subject; done\n```\n\n- - - -\n\n# Music\n[Pine Hill Haints - Jack o' Diamonds](https://serioussambarrett.bandcamp.com/track/jack-o-diamonds)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpgporada%2Fct-trusted-roots","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpgporada%2Fct-trusted-roots","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpgporada%2Fct-trusted-roots/lists"}