Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that the Root CA bundles differ between OS/browsers/applications. However, it seems like Verisign is always included.

How did this become the case? Is there some sort of standard?

I'm just curious since SSL has become a big topic lately at my place of work.

share|improve this question
up vote 3 down vote accepted

There is no standard set of certificate authorities, and the list of trusted authorities may vary from one application to another. Linux Weekly News had an interesting article about this last August.

share|improve this answer

Verisign has a very large customer base and has been around for a long time. Omitting it would cause problems for a large percentage sites. This would be a problem for users, and consequently would cause them to change to different tool.

Most tools allow you to check the trust chain so you can verify what your experience would be like if Verisign was not in the CA bundle. I sometime clean the bundle of CAs that I am unlikely to trust, but always keep Verisign.

Some tools such a VPNs allow users to specify their own trusted authorities. With a private CA this can greatly simplify trust relationships.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.