# What Is Trust Store (Root store, CA store)?

> Trust stores are collections of root CA certificates that an operating system, browser or runtime treats as trust anchors when validating chains.

Source: https://ssl.sh/glossary/trust-store/
Last updated: 2026-11-10

A trust store is the list of [root certificates](https://ssl.sh/glossary/root-certificate/) a TLS client accepts as the end point of a chain. The major stores are maintained by [root programs](https://ssl.sh/glossary/root-program/): Microsoft for Windows, Apple for macOS and iOS, Mozilla for Firefox (its NSS list is also the basis of most Linux ca-certificates packages), and Google's Chrome Root Store. Language runtimes may bring their own: Java has `cacerts`, while Python's `certifi` package and Node.js ship copies of Mozilla's list.

## Why it matters
Whether a certificate is "trusted" depends entirely on which store the client consults. A site can pass in a browser but fail in a Docker container with an outdated ca-certificates package, an old Java runtime or a pinned certifi version. Distrust decisions also reach users through store updates, so keeping stores current matters as much as patching software. For internal services, adding your [private CA](https://ssl.sh/glossary/private-ca/) root to the relevant stores is the correct way to establish trust.

## Example
On Debian and Ubuntu, add an internal root to the system store:

```bash
sudo cp internal-root.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates
```

Java and some other runtimes still need the root imported separately.

## Common misconceptions
- **There is one trust store per computer.** Browsers, the OS, Java, Python and Node.js can each consult different stores.
- **Adding a missing intermediate to the trust store is the right fix.** That masks a server misconfiguration; the server should send its intermediates.
- **Disabling verification is fine for testing.** Flags like `curl -k` or `verify=False` turn off authentication completely and tend to leak into production code.

## Related terms

- [根证书](https://ssl.sh/zh/glossary/root-certificate/): 根证书是位于证书链顶端、由 CA 自签名的证书，预装在操作系统或浏览器的信任库中，作为验证其他证书的信任锚。
- [CA Bundle](https://ssl.sh/zh/glossary/ca-bundle/): CA Bundle 是把多张 PEM 证书拼接在一起的文件，既可能是服务器要发送的中间证书链，也可能是客户端信任的根证书集合。
- [根证书计划](https://ssl.sh/zh/glossary/root-program/): 根证书计划是浏览器或操作系统厂商用来决定其信任库收录、限制或移除哪些根 CA 的政策与流程。
- [证书链](https://ssl.sh/zh/glossary/certificate-chain/): 证书链是从网站终端证书经中间证书一直到受信任根证书的有序证书序列，每一张都由下一张签名。
- [私有 CA](https://ssl.sh/zh/glossary/private-ca/): 私有 CA 是企业为自己的系统和设备搭建的证书颁发机构，其根证书只在企业主动安装的设备上受信任。
- [CCADB](https://ssl.sh/zh/glossary/ccadb/): CCADB 是通用 CA 数据库，CA 在这里向各根证书计划披露其根证书、中间证书、审计报告、政策文件和 CRL 地址。