Certificate authority download: how to get a CA certificate and check it

9 min readUpdated Oct 2026

A CA certificate comes from one of four places: the certificate authority's own repository, the issuer link inside a certificate you already hold, the trust store of your system or browser, or a published trust bundle. Whichever you use, compare the fingerprint before you install anything. This page shows where each source is, which command fetches the file, and how to confirm it is the certificate you meant to get. For what a certificate holds, start with the SSL certificate guide. For the role of the authority itself, see what a certificate authority does. A root certificate sits at the top of a chain and an intermediate certificate sits between it and the server certificate. Both are CA certificates, and both can be downloaded the same way.

Issuer link: A certificate can name where the certificate of its issuing CA can be fetched, in its Authority Information Access extension ^[1]
Format on that link: Over HTTP or FTP the link must point to a single DER-encoded certificate or to a "certs-only" CMS message ^[1]
Fingerprint: OpenSSL calculates it as a digest of the DER-encoded form of the entire certificate ^[2]
Windows: certutil -store takes a store name such as Root, an optional certificate ID and an optional output file ^[3]
macOS: Keychain Access exports certificates with File > Export Items, in the file format you choose ^[4]
Bundle: curl publishes the Mozilla CA certificate store in PEM format, with a sha256sum of the file ^[5]

Where to download a CA certificate

Pick the source by what you already have. A certificate in hand points to its issuer. A device points to its own trust store. A CA name points to the CA's website.

Where to download a CA certificate
Source	What you get	Check it against
The CA's own repository	The root and intermediate certificates that CA publishes	A fingerprint from the same CA, ideally on a separate page
The issuer link in a certificate you hold	The certificate of the CA that signed it, one level up ^[1]	The issuer name printed in the certificate you started from
The trust store of a system or browser	The CA certificates that device already holds	Nothing to compare; you are copying what is already local
A published trust bundle	Many root certificates in one PEM file ^[5]	The sha256sum the publisher posts for the file ^[5]
Your organisation's own CA	Its root and intermediate files	The fingerprint from the team that runs it

Downloading a CA certificate does not issue one for your site. For CAs that issue certificates at no charge, see free public certificate authorities.

Download from the CA's repository

The CA's own website is the place to start. Search for the CA's name together with the word repository, then follow these steps.

Open the site by typing its address or from a link inside the certificate. Do not start from an advert or a forwarded email.
Find the entry by the subject name of the certificate you need, not by product name. Choose root or intermediate to match the chain you are building.
Download the file in the format offered. A repository can offer the same certificate as PEM, DER or a bundle; certificate formats explains which one a server, a browser or OpenSSL expects.
If the repository lists a fingerprint beside the file, copy it into a note. You will compare it in the last section.

Get the issuer certificate from a certificate you already have

A certificate can carry the address of its issuer's certificate. In the Authority Information Access extension this is the caIssuers entry, defined by RFC 5280 for the CA that signed the certificate ^[1]. OpenSSL prints extensions by name, and caIssuers is one of the access methods it knows ^[6]. Start from a server certificate saved as server.pem:

openssl x509 -in server.pem -noout -ext authorityInfoAccess

Look for the CA Issuers line. It carries a URL. Download it:

curl -o issuer.cer URL-from-the-CA-Issuers-line

Over HTTP or FTP that URL must point to one DER-encoded certificate or to a "certs-only" CMS message ^[1]. In the first case, tell OpenSSL the format with -inform DER when you open the file, and you are looking at the certificate of the next CA up. Run the same command on it and you reach the CA above that one. When a certificate has no CA Issuers line, it does not name a download location; use the repository of the CA instead. The certificate chain page shows how the levels stack.

Export from a trust store or take a bundle

A device already holds CA certificates, and you can copy any root certificate out of its trust store. The result is a CA certificate file like one from a repository, so the issuer and fingerprint checks below apply to it, whether the file is PEM or DER.

Windows. certutil -store Root addresses the Root store. The syntax also takes an optional certificate ID and an optional output file name ^[3].
macOS. In Keychain Access, select the certificate, choose File > Export Items, and pick the file format in the dialog ^[4].

For a whole trust bundle at once, curl publishes the Mozilla CA certificate store converted to PEM, with a sha256sum of the file ^[5]. One limit applies. The curl page warns that several of those CAs carry constraints in Firefox and other browsers, limiting them to certain domains, and that those constraints are not brought along in the converted file ^[5]. A bundle carries the certificates themselves. It does not reproduce every restriction placed on them.

Check what you downloaded before you trust it

A downloaded CA certificate is only as good as the check you run on it. These steps apply to a CA certificate from any of the sources above.

Print its subject, issuer and fingerprint. Add -inform DER if the file is DER:

openssl x509 -in ca.crt -noout -subject -issuer -fingerprint -sha256

Read the subject. It must name the CA you meant to download.
Compare the fingerprint with the value the CA published, or with the sha256sum the bundle publisher posts ^[5]. OpenSSL takes the digest over the DER-encoded form of the entire certificate ^[2], so a PEM copy and a DER copy of one certificate give the same value. A mismatch means a different file: discard it and download again from the CA's site.
Read the issuer. For an intermediate, the issuer is the CA above it, so the issuer link step from the section above repeats one level up.
Install only a file whose fingerprint matched. The root certificate page explains how stores take it, and the OpenSSL commands page has more checks.

FAQ

Where can I find a list of certificate authority certificates?

Three places. Your operating system or browser keeps its own CA certificate set in its trust store. The curl project publishes a trust bundle, the Mozilla CA certificate store converted to PEM, and the converted file does not carry the domain constraints that Firefox applies to some CAs. Each certificate authority also lists its root certificate and intermediate certificate files in its repository. Check the fingerprint of whichever file you take.

Where can I download the trusted root CA certificates?

To download a CA certificate, use the repository of the certificate authority that issued yours, or the issuer link inside the certificate, as the section above shows. A root certificate copied from a trust store works too. Compare the fingerprint of the file with a value the CA published before you install it.

How do I download and install a root certificate?

Download the root certificate from the CA's repository, in PEM or DER, and print its fingerprint with openssl x509 -noout -fingerprint -sha256. Compare it with the published one. Install it into the trust store only when the two match. Root certificates and trust stores covers the install step for each platform.

Sources

RFC 5280, Internet X.509 Public Key Infrastructure Certificate and CRL Profile, section 4.2.2.1 Authority Information Access.
OpenSSL 3.0 manual, openssl-x509: the -inform, -noout, -ext and -fingerprint options.
Microsoft Learn, certutil, the -store parameter, learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil.
Apple Support, Import and export keychain items using Keychain Access on Mac, support.apple.com/guide/keychain-access/export-items-from-a-keychain-kyca35961/mac.
curl, CA certificates extracted from Mozilla: the cacert.pem bundle, its sha256sum and the Missing Name Constraints note.
OpenSSL 3.0 manual, x509v3_config, Authority Info Access, docs.openssl.org/3.0/man5/x509v3_config/.