-
-
RootWatch Dashboard Layout
Interactive Control Plane: Built a lightweight Flask backend paired with an intuitive dashboard interface that gives visibility into all local trust stores, displays vulnerability statuses, and lets users trigger cross-system audits and patches on demand.
Store Discovery and Parsing Engine: Mapped out the diverse and fragmented locations where runtimes stash their trust anchors, including /etc/ssl/certs for the system, certifi bundles inside Python site-packages, NSS databases (cert9.db) used by Firefox and Chromium, Java Keystores (cacerts), and curl's default bundle paths.
Targeted In-Place Remediation: Implemented safe, surgical certificate stripping. RootWatch parses certificate bundles and databases, finds the matching Subject Key Identifier or fingerprint of the compromised root or intermediate (such as the eMudhra certificates), and marks it explicitly distrusted or unlinks it without corrupting file integrity or application permissions.
Automated Verification Harness: Integrated an automated TLS verification test against a mock local server on 127.0.0.1:8443 serving certificates signed by the revoked root. The tool executes real handshakes via curl, Python requests, and native sockets to programmatically confirm that connection attempts now throw untrusted root or certificate errors.
Challenges we ran into:
Safe Sandbox Testing: Testing destructive trust-store modifications on our daily-driver workstations was risky. One corrupt keystore or bad system certificate bundle could break OS updates, package managers, or local dev workflows. We solved this by containerizing our entire evaluation harness in Docker, simulating an environment with multiple vulnerable application runtimes and a local mock MITM server to safely test distrusting routines.
Format and Database Fragmentation: There is no universal standard for CA storage. Plain PEM bundles (.pem and .crt), binary Java KeyStores (JKS and PKCS12 via keytool), and SQLite-based Mozilla NSS databases all require completely different APIs, binary manipulations, and permission handling to modify cleanly.
Accomplishments that we're proud of:
Closed the Revocation Lag: Created a working proof-of-concept that solves a genuine blind spot in application-level PKI, eliminating the weeks-long window where an upstream maintainer hasn't yet bumped their certifi or curl dependencies.
End-to-End Automated Pipeline: Bridged the gap between discovery, atomic remediation, and post-patch validation across multiple disconnected runtimes in a single click.
Real-World Impact: Simulated the exact conditions of the eMudhra incident and proved that RootWatch could successfully immunize a system against active rogue certificates before official per-app vendor patches drop.
What we learned:
The Reality of PKI Fragility: We discovered how heavily non-browser applications rely on static trust bundles. Outside of major browsers with OneCRL or CRLSets, runtime revocation checking via OCSP or CRLs is virtually non-existent in command-line tools and scripting libraries, meaning static trust store hygiene is often an application's only line of defense. We also learned Deep Cryptographic concepts: Gained a deep understanding of X.509 certificate chains, serial numbers, trust store formats across different runtimes (NSS, JKS, OpenSSL), and how certificate pinning interacts with local trust stores.
What's next for RootWatch:
Broader Application Coverage: Expand out-of-the-box discovery to include Go compiled binaries, Node.js baked-in roots, Docker daemon trust stores, and native macOS Keychain and Windows Certificate Manager APIs. Automated CRL and Certificate Transparency Feeds: Connect RootWatch to real-time CRL updates and Certificate Transparency monitors to autonomously flag newly revoked roots and suggest patches the moment a revocation is published. Active Network and OCSP Validation: Add active probes to test external endpoints, verify OCSP stapling enforcement, and audit outbound client applications to ensure they enforce modern revocation checks.
