What are all these security certificates on new phone?

Question

This is a new T-Mobile Samsung Galaxy S7.

Is it normal to have all these certificates? Many look dodgy.

^{Image resized. Click to see full-version}

Answer 1

Yes, it is normal to have these security certificates.

To trust a security certificate you encounter on the Internet, your device needs a way to verify a certificate is good. You can't just accept any certificate that is presented because any adversary able to become a man-in-the-middle (like a public WiFi access point) would be able to spoof any website.

This problem has been solved by giving each device a list of certificates initially, like the one you have shown, and requiring all certificates to have a chain of valid certificates (signed, not expired) that terminates with a trusted certificate. These initial trusted certificates are for organizations that are in the business of signing certificates for other organizations. People need certificates all over the world which is why there are certificates for authorities from all over the world. To verify a certificate, the device looks for a chain of valid certificates.

This means that if you run a server and want a certificate, you have to go to one of the companies that issues certificates (often called a certificate authority) and get them to sign a certificate for you to identify your server. The certificate includes the name of the server so you cannot just take a certificate and use it anywhere.

With certificates, an adversary can still try to spoof any website, but if you require a certificate (use HTTPS) the client can detect the spoofing.

Answer 2

The certificates are very necessary! Without them your phone would just say that any site you visit is trying to steal your data and is not secure.