Trust Store (Root store, CA store)

A trust store is the list of root certificates a TLS client accepts as the end point of a chain. The major stores are maintained by root programs: Microsoft for Windows, Apple for macOS and iOS, Mozilla for Firefox (its NSS list is also the basis of most Linux ca-certificates packages), and Google's Chrome Root Store. Language runtimes may bring their own: Java has cacerts, while Python's certifi package and Node.js ship copies of Mozilla's list.

Why it matters

Whether a certificate is "trusted" depends entirely on which store the client consults. A site can pass in a browser but fail in a Docker container with an outdated ca-certificates package, an old Java runtime or a pinned certifi version. Distrust decisions also reach users through store updates, so keeping stores current matters as much as patching software. For internal services, adding your private CA root to the relevant stores is the correct way to establish trust.

Example

On Debian and Ubuntu, add an internal root to the system store:

sudo cp internal-root.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

Java and some other runtimes still need the root imported separately.

Common misconceptions

• There is one trust store per computer. Browsers, the OS, Java, Python and Node.js can each consult different stores.
• Adding a missing intermediate to the trust store is the right fix. That masks a server misconfiguration; the server should send its intermediates.
• Disabling verification is fine for testing. Flags like curl -k or verify=False turn off authentication completely and tend to leak into production code.