TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1

Check whether your device trusts it

Each platform keeps its own root store. The commands below look up TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1 by common name (TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1) or fingerprint. The store status in each heading comes from the CCADB snapshot; your device can differ if it is out of date or managed by an administrator.

macOS (Apple store: Included · Trusted for TLS)

Search the system roots keychain by common name. -Z prints the SHA-256 hash, which must match the fingerprint on the last line.

security find-certificate -a -c "TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1" -Z \
  /System/Library/Keychains/SystemRootCertificates.keychain | grep "SHA-256"
# SHA-256 hash: 46EDC3689046D53A453FB3104AB80DCAEC658B2660EA1629DD7E867990648716

Windows (Microsoft store: Included · Trusted for TLS)

Windows identifies roots by SHA-1 thumbprint. It installs third-party roots on demand through Automatic Root Certificates Update, so "not found" can also mean the root has not been needed yet; certutil -generateSSTFromWU roots.sst downloads Microsoft's full list.

certutil -verifystore Root 3143649BECCE27ECED3A3F0B8F0DE4E891DDEECA

Linux (ca-certificates follows Mozilla: Included · Trusted for TLS)

Debian, Ubuntu, Fedora and RHEL build their ca-certificates package from Mozilla's root store. Use trust list on p11-kit systems, or search the PEM bundle on Debian and Ubuntu.

# Fedora / RHEL / Arch (p11-kit)
trust list --filter=ca-anchors | grep -iF -A2 "TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1"
# Debian / Ubuntu (ca-certificates)
openssl crl2pkcs7 -nocrl -certfile /etc/ssl/certs/ca-certificates.crt \
  | openssl pkcs7 -print_certs -noout | grep -iF "TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1"

Java

Java ships its own cacerts keystore; JDK 9 and later accept -cacerts and the default store password is changeit. Search for the SHA-256 fingerprint in colon form.

keytool -list -cacerts -storepass changeit | grep -i "46:ED:C3:68:90:46:D5:3A:45:3F:B3:10:4A:B8:0D:CA:EC:65:8B:26:60:EA:16:29:DD:7E:86:79:90:64:87:16"

Android

Android's system store is maintained by Google separately from the four CCADB stores above. Open Settings → Security & privacy → More security settings → Encryption & credentials → Trusted credentials → System (menu names vary by vendor and version) and look for Turkiye Bilimsel ve Teknolojik Arastirma Kurumu - TUBITAK → TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1.

Which root does my site chain to?

List the chain your server sends and compare the last issuer with this root; the fingerprint check confirms a local copy.

Download PEM

# show subject (s:) and issuer (i:) of every certificate the server sends
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null \
  | grep -E '^ *[0-9]+ s:|^ *i:'
# subject and SHA-256 fingerprint of the downloaded PEM file
openssl x509 -in kamu-sm-tubitak-kamu-sm-ssl-kok-sertifikasi-surum-1.pem -noout -subject -fingerprint -sha256
# sha256 Fingerprint=46:ED:C3:68:90:46:D5:3A:45:3F:B3:10:4A:B8:0D:CA:EC:65:8B:26:60:EA:16:29:DD:7E:86:79:90:64:87:16