Root CA Certificate Repository

Root Certificate Authorities (CAs) are the top-level entities in the public key infrastructure (PKI) trust chain. Browsers, operating systems, and applications ship with a built-in list of trusted root CAs. When a server presents a TLS/SSL certificate, its chain of trust must lead back to one of these roots for the connection to be considered secure.

Full CA bundles (like cacert.pem from curl) contain over 100 certificates. For constrained environments — embedded devices, IoT firmware, minimal containers, or applications that only connect to specific services — importing the entire bundle is unnecessary. Selecting only the roots you need reduces attack surface and keeps your trust store lean.

PEM (Privacy Enhanced Mail) is a base64-encoded format for storing cryptographic objects such as certificates. PEM certificates are plain text files beginning with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE-----. They use the .pem or .crt extension and are the most widely supported format across Linux, macOS, and web servers such as nginx and Apache.

Linux (system-wide): copy the .pem file to /usr/local/share/ca-certificates/ (rename to .crt first on Debian/Ubuntu), then run sudo update-ca-certificates.

macOS: double-click the file and add it to Keychain Access, then set trust to "Always Trust" under the certificate's settings.

Windows: rename to .crt, double-click, and use the Certificate Import Wizard to add it to the "Trusted Root Certification Authorities" store.

Python / requests: pass the file path to the verify= parameter, or append it to your system's CA bundle.

These certificates are extracted from the Mozilla CA Certificate Store, the same root store used by Firefox and distributed by curl as cacert.pem. Mozilla maintains this list through its CA Inclusion Policy, which requires CAs to meet rigorous security and audit standards.