Trusted root CAs

When the scanner validates a certificate chain, it trusts the root authorities in the table below, which this page loads live from the running server (so it needs JavaScript). The store is assembled from three sources: the operating-system store, the Node.js bundle (Mozilla CA list compiled into the runtime), and our own weekly CCADB/Mozilla TLS-root snapshot (data/ccadb-roots.pem, refreshed via scripts/update-ca-bundle.js). The snapshot ADDS roots that the OS/Node bundle does not carry yet. Note how the three sources are combined: as a union – the store only ever adds anchors, it never removes one. A root that Mozilla has since distrusted therefore stays trusted here as long as the OS or the Node bundle still ships it, which is why the certificate check compares the anchor a chain ends in against the current Mozilla/CCADB set separately and warns when it is no longer part of it: such a certificate validates here and is refused by Firefox.

This list is generated live from the running server, so it reflects exactly what is trusted right now. Entries are deduplicated by certificate fingerprint.