Useful Resources

CCADB Support

• For problems or questions when using the CCADB, please contact support [at] ccadb [dot] org.
• You can record enhancements, bugs, and API access requests in the ‘Common CA Database’ component under the ‘CA Program’ product in Bugzilla.

CCADB Data

• CCADB Data Usage Terms
• Code Signing Root Certificates
  • PEM of Root Certificates in Microsoft’s Root Store with Code Signing EKU (TXT)
  • PEM of Root Certificates in Microsoft’s Root Store with Code Signing EKU (CSV)
• Email (S/MIME) Root Certificates
  • PEM of Root Certificates in Mozilla’s Root Store with the Email (S/MIME) Trust Bit Enabled (TXT)
  • PEM of Root Certificates in Mozilla’s Root Store with the Email (S/MIME) Trust Bit Enabled (CSV)
• Server Authentication (SSL/TLS) Root Certificates
  • PEM of Root Certificates in Mozilla’s Root Store with the Websites (TLS/SSL) Trust Bit Enabled (TXT)
  • PEM of Root Certificates in Mozilla’s Root Store with the Websites (TLS/SSL) Trust Bit Enabled (CSV)

All Certificate Information Reports — Description of Fields in All Certificate Information Reports

• Version 3 [OBSOLETE] V3 All Certificate Information (root and intermediate) in CCADB (CSV)
• Version 4 V4 All Certificate Information (root and intermediate) in CCADB (CSV)
  • V4a: https://ccadb.my.salesforce-sites.com/ccadb/AllCertificateRecordsCSVFormatV4a (Records of CA certificates, exlcuding those that expired more than five years ago)
  • V4b: https://ccadb.my.salesforce-sites.com/ccadb/AllCertificateRecordsCSVFormatV4b (Records of CA certificates expired over five years ago)
    These two reports–V4a and V4b–are mutually exclusive partitions of the full dataset for V4 and can be combined to reconstruct the complete list.
• Version 5 - V5 All Certificate Information (root and intermediate) in CCADB (CSV)

• Version 6 - REST API - work in progress

• All Included Root Certificate Trust Bit Settings (CSV)
• List of CA problem reporting mechanisms (email, etc.) (use this to report a certificate problem directly to the CA)
  • CSV List of CA problem reporting mechanisms (email, etc.)
• [OBSOLETE] List of CAA Identifiers (used to restrict issuance of certificates to specific CAs via a DNS Certification Authority Authorization Resource Record)
  • [OBSOLETE] CSV List of CAA Identifiers
• List of CAA Identifiers (used to restrict issuance of certificates to specific CAs via a DNS Certification Authority Authorization Resource Record)
  • CSV List of CAA Identifiers

All Certificate PEMs

The AllCertificatePEMsCSVFormat report accepts one of the following two parameters: NotBeforeYear or NotBeforeDecade.

Examples:

• https://ccadb.my.salesforce-sites.com/ccadb/AllCertificatePEMsCSVFormat?NotBeforeYear=1999
  • Provides the certificate PEMs for which the CCADB record has a ‘Valid From (GMT)’ field that contains 1999.
• https://ccadb.my.salesforce-sites.com/ccadb/AllCertificatePEMsCSVFormat?NotBeforeDecade=2010
  • Provides the certificate PEMs for which the CCADB record has a ‘Valid From (GMT)’ field that contains 2010.

Mozilla

• Root Program Documentation
• Root Store Policy
• CA Communications
• CA Incident Dashboard
• dev-security-policy WebPKI Forum

Microsoft

• Trusted Root Program Requirements
• Trusted Root Certificate Program Updates
• Trusted Root Audit Requirements

Google Chrome

• Chrome Root Program Policy
• Chrome Root Store & Certificate Verifier FAQ

General

• crt.sh Certificate Search
• Censys Certificate Search
• Certificate Explainer
• public@ccadb.org WebPKI Forum
• Trust Service Provider Technical Best Practices
• Qualified Website Authentication Certificates (QWACs) Interoperability