CCADB (Common CA Database)

The CCADB (Common CA Database) was created by Mozilla and is now used jointly by major root programs, including those of Mozilla, Microsoft, Google and Apple. CAs record every root and intermediate certificate that chains to an included root, together with audit statements, Certificate Policy and CPS documents, and the URLs of their full CRLs. Root programs use it to review inclusion requests, track audit deadlines and manage CA records in one place.

Why it matters

Disclosure turns the web PKI's intermediates into an inventory that anyone can check. An intermediate that chains to a trusted root but is missing from the CCADB is itself a compliance incident, and root programs read the audit reports stored there when deciding whether to keep trusting a CA. The CRL URLs disclosed in the CCADB are what Mozilla uses to build CRLite, which matters more now that Ballot SC-063 has made CRLs mandatory and OCSP optional.

Example

Get the SHA-256 fingerprint of an unfamiliar intermediate from a chain:

openssl x509 -in intermediate.pem -noout -fingerprint -sha256

Searching the CCADB's published reports for that fingerprint shows which CA operates the intermediate, its audit statements, and whether it is technically constrained or revoked.

Common misconceptions

• The CCADB is a trust store. Being listed is not the same as being trusted; each vendor still decides which roots to include.
• Only root certificates are recorded. Every intermediate capable of issuing publicly trusted certificates must be disclosed too.
• It is run by the CA/Browser Forum. It is operated for the root store operators and is separate from the Forum.