Identification of trusted certificates

A system comprising at least one computing device that implements a certificate management service, wherein the certificate management service:

• receives, at an application, a digital certificate;
• determines that the digital certificate is signed by a trusted certificate authority, the trusted certificate authority represented in a trust store maintained by the at least one computing device, the trust store usable by a plurality of applications hosted by the at least one computing device;
• identifies a first rule that is applicable based at least in part on an identity of the application, the first rule based at least in part on a number of signing entities in a chain of trust of the digital certificate;
• identifies the number of signing entities in the chain of trust;
• determines that the digital certificate violates the first rule, the first rule being adapted to the application;
• as a result of having determined that the digital certificate violates the first rule, indicates to the application that the digital certificate is not trustworthy;
• and
• operates in accordance with the digital certificate not being trusted by the application while maintaining validity of the digital certificate for use by at least one other application of the plurality of applications.

A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least

• determine whether a digital certificate received by an application is trustworthy by at least:
• determining that the digital certificate is signed by a trusted certificate authority, the trusted certificate authority represented in a trust store maintained by the computer system, the trust store usable by a plurality of applications, including the application, hosted by the computer system;
• obtaining a rule set based at least in part on an identity of the application, a particular rule of the set based at least in part on a number of signing entities in a chain of trust of the digital certificate;
• performing, based at least in part on the particular rule in the rule set, an evaluation of a characteristic of the trusted certificate authority, the evaluation including, for the particular rule, determining the number of signing entities;
• determining that the digital certificate is not trustworthy based at least in part on a result of the evaluation;
• and
• operating in accordance with the digital certificate not being trusted by the application while maintaining validity of the digital certificate for use by one or more of the applications hosted by the computer system.