{"id":532,"date":"2015-10-28T11:22:08","date_gmt":"2015-10-28T19:22:08","guid":{"rendered":"http:\/\/unmitigatedrisk.com\/?p=532"},"modified":"2015-10-28T11:22:32","modified_gmt":"2015-10-28T19:22:32","slug":"pkijs-and-trust-lists","status":"publish","type":"post","link":"https:\/\/unmitigatedrisk.com\/?p=532","title":{"rendered":"PKIjs and trust lists"},"content":{"rendered":"<p>As you probably know Yury and I think Same Origin Certificates (or <a href=\"https:\/\/unmitigatedrisk.com\/?p=503\">Browser Bound Certificates<\/a>) are the way PKI enabled applications will be built in the future. This is why we have been working on <a href=\"http:\/\/pkijs.org\">PKIjs<\/a>\u00a0for so long.<\/p>\n<p><span style=\"font-weight: 400;\">One of the issues you have when building applications that use this concept is deciding what Certificate Authorities you should trust. The answer to that question is pretty nuanced but the short version is only as many as you absolutely need to.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">There are four\u00a0trust stores that I personally think are interesting when thinking about digital signatures these include\u00a0<a href=\"https:\/\/www.mozilla.org\/en-US\/about\/governance\/policies\/security-group\/certs\/policy\/\">Mozilla\u2019s<\/a>, <a href=\"https:\/\/technet.microsoft.com\/en-us\/library\/cc751157.aspx?f=255&amp;MSPPError=-2147217396\">Microsoft\u2019s<\/a>, Adobe&#8217;s\u00a0and the <a href=\"https:\/\/ec.europa.eu\/digital-agenda\/en\/eu-trusted-lists-certification-service-providers\">EUTL<\/a><\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">If you want to work with these lists you need to be able to parse them and get the CA certificates that are meaningful to you.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">This is why we have created <a href=\"https:\/\/github.com\/PeculiarVentures\/tl-create\">tl-create<\/a><\/span><span style=\"font-weight: 400;\">, it can (at the time of this post) parse the Mozilla list and the EUTL list.<\/span><sup>*<\/sup><\/p>\n<p><sup>* At this time the EUTL trust list does no signature verification and should only be used for experimentation.<\/sup><\/p>\n<p><span style=\"font-weight: 400;\">The output of which is either a PEM bag of certificates or Javascript array\u00a0that you can import into your PKIjs based applications as trust anchors.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Hopefully you will find this interesting and useful, pull requests are welcomed.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>As you probably know Yury and I think Same Origin Certificates (or Browser Bound Certificates) are the way PKI enabled applications will be built in the future. This is why we have been working on PKIjs\u00a0for so long. One of the issues you have when building applications that use this concept is deciding what Certificate [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[26,3,4],"tags":[178,179,180],"class_list":["post-532","post","type-post","status-publish","format-standard","hentry","category-opensource","category-security","category-thoughts","tag-eutl","tag-roots","tag-trust"],"_links":{"self":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=532"}],"version-history":[{"count":0,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=\/wp\/v2\/posts\/532\/revisions"}],"wp:attachment":[{"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/unmitigatedrisk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}