[etc] Chromium root store

[janbrasna]

Neither Android nor Chrome trust store is included in etc exports, noting:

Google Chromium uses basically the trust stores above, see https://www.chromium.org/Home/chromium-security/root-ca-policy.

However, Chromium no longer relies on the underlying OS, as quoted from the link:

"In Chrome 105, Chrome began a platform-by-platform transition from relying on the host operating system’s Root Store to its own on Windows, macOS, ChromeOS, Linux, and Android. […] Apple policies prevent the Chrome Root Store and corresponding Chrome Certificate Verifier from being used on Chrome for iOS. Learn more about the Chrome Root Store and Chrome Certificate Verifier here."

So taking the table from chromium/src/[~]/ssl/chrome_root_store/faq.md it maps to:

Chrome on...*	Rollout Began**	Enabled by Default
Android	Chrome 114	Chrome 115
Chrome OS	Chrome 114	Chrome 114
iOS***	N/A	N/A
Linux	Chrome 114	Chrome 114
macOS	Chrome 105	Chrome 108
Windows	Chrome 105	Chrome 108

There are two sources, one we used for years to map as "Android" roots: https://pki.goog/roots.pem and also now the chromium reference to its src: https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/root_store.md

(Not sure how these map to Mozilla/NSS or Microsoft/SChannel exports as compared to just CCADB that all of these are a member of anyways…)

[janbrasna]

IIUC it's here: https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/root_store.certs

[drwetter]

Ah, cool. That makes matters easier than I thought. How does one retrieve the raw file?

The android root CAs you mentioned above contain only 36 certificates

[janbrasna]

In theory the txt format link in footer should work: root_store.certs?format=TEXT

(ah yea it'd probably need base64decoding tho: google/gitiles#106 ;D)

[janbrasna]

Truth is I got a bit lost in the Android roots, as the current repo seems rather complicated (and the individual certs stored as separate files at main…):

• https://android.googlesource.com/platform/system/ca-certificates/
• https://android.googlesource.com/platform/system/ca-certificates/+/refs/heads/main
• https://android.googlesource.com/platform/system/ca-certificates/+/refs/heads/main/README.cacerts

E.g. some refs/releases include the roots.pem:

• https://android.googlesource.com/platform/system/ca-certificates/+/refs/heads/android14-platform-release/google/roots.pem
  (but that means tracking and understanding the individual refs to point at the "right" bundle…)