Skip to main content
Security

Root Certificate Authority

Unless your browser already supports DANE, you'll need update your root CA's!

Click the big certificate below to install the Pacy World TDMC, Inc. root CA in your browser. For a detailed explanation on what this is continue reading.

To install it system-wide, click to view the Installation instructions for your operating system. Bootstraping the Pacy World Root CA requires manual verification to prevent Man-in-the-Middle attacks. Use the fingerprint to verify your download.

Root CA Certificate

Pacy World Root CA

TDMC, Inc. - July 2018

SHA-256 Fingerprint

Confirm this matches after downloading to verify authenticity.

22d07a03345496ea9dc3ee767c991117e355405cab8d13e98d192474ef0296ce

Certificate Chain

Root CA
Intermediate CA
*.pacyworld.com, *.morante.com, *.securemessage.cc, …
Download Certificate Installation Guide
Root + Intermediate • Intermediate Only
Background

Why Do I Need This?

If you are having problems loading web pages and the error message is similar to "This Connection Is Untrusted" or "NET::ERR_CERT_AUTHORITY_INVALID", then your browser does not support DANE and is missing root certificates. Browsers ship with a limited set of pre-trusted CAs and you need to add more in order to browse websites securely.

DANE is an emerging standard that eliminates this by publishing trust anchors in DNSSEC-secured DNS. Until universal adoption, manual installation remains necessary.

A website that uses encryption to protect your privacy and sensitive information relies on something called a TLS certificate chain in order to validate the content is indeed from the original source.

Unfortunately due to the design of the current implementation of TLS certificates, many web browsers are highly dependant on centralized entities called "Certificate Authorities" (CA) to make this work. It's impossible for a web browser vendor to a pre-load every CA in existence, your browser vendor may simply not know about them.

DANE which stands for "DNS-based Authentication of Named Entities", is a technology that decentralizes the validation of a TLS certificate chain. Thus removing the need for software like a web browser to have to keep a local store of Root CA's. This is still a new emerging technology and not all browsers support it as of 2026. We are currently developing Bloom Browser, a web browser with built-in DANE support that will eliminate the need for manual CA installation entirely.

It's up to you (the end user) to install any missing CA's so that you can properly open web pages. You may also want to kindly send a note to your browser vendor informing them of the CA's they missed so that other users won't have to go through the same trouble you did. Usually this is done in the form of a bug report or support ticket.

Setup

Installation Instructions

Select your operating system for step-by-step instructions.

1. Download & verify:

fetch -qo /tmp/alt_ca.crt \
    https://cdn.pacyworld.com/pacyworld.com/ca/alt_ca-morante_root.crt
sha256 -q /tmp/alt_ca.crt

2. Confirm the hash matches the fingerprint above, then install:

mv /tmp/alt_ca.crt /usr/share/certs/trusted/alt_ca-morante_root.pem
certctl rehash
Secure one-liner (download + verify + install) 
fetch -qo /tmp/ca.crt https://cdn.pacyworld.com/pacyworld.com/ca/alt_ca-morante_root.crt && [ "$(sha256 -q /tmp/ca.crt)" = "22d07a03345496ea9dc3ee767c991117e355405cab8d13e98d192474ef0296ce" ] && mv /tmp/ca.crt /usr/share/certs/trusted/alt_ca-morante_root.pem && certctl rehash || echo "FAILED: Hash mismatch"

1. Download & verify:

wget -qO /tmp/alt_ca.crt \
    https://cdn.pacyworld.com/pacyworld.com/ca/alt_ca-morante_root.crt
sha256sum /tmp/alt_ca.crt

2. Confirm the hash matches, then install:

sudo mv /tmp/alt_ca.crt /usr/local/share/ca-certificates/alt_ca-morante_root.crt
sudo update-ca-certificates

1. Download & verify:

curl -so /tmp/alt_ca.crt \
    https://cdn.pacyworld.com/pacyworld.com/ca/alt_ca-morante_root.crt
sha256sum /tmp/alt_ca.crt

2. Confirm the hash matches, then install:

sudo mv /tmp/alt_ca.crt /etc/pki/ca-trust/source/anchors/alt_ca-morante_root.crt
sudo update-ca-trust extract

1. Download & verify:

curl -so ~/Downloads/alt_ca.crt \
    https://cdn.pacyworld.com/pacyworld.com/ca/alt_ca-morante_root.crt
shasum -a 256 ~/Downloads/alt_ca.crt

2. Confirm the hash matches, then install to the System Keychain:

sudo security add-trusted-cert -d -r trustRoot -k \
    /Library/Keychains/System.keychain ~/Downloads/alt_ca.crt

Option A: Provisioning Package (Recommended)

Download and double-click the provisioning package. When prompted "Is this package from a source you trust?", click Yes, add it.

pacyworld-root-ca.ppkg SHA256: 221D9FC9E23A8B732374507C1D5F484128D361B2805315CBA41831AF23B5B085

Option B: PowerShell

$url = "https://cdn.pacyworld.com/pacyworld.com/ca/alt_ca-morante_root.crt"
$path = "$env:USERPROFILE\Downloads\pacyworld-root-ca.crt"
Invoke-WebRequest -Uri $url -OutFile $path

# Verify hash
Get-FileHash -Algorithm SHA256 $path
# Expected: 22D07A03345496EA9DC3EE767C991117E355405CAB8D13E98D192474EF0296CE

# Import into trusted root store (requires admin)
Import-Certificate -FilePath $path -CertStoreLocation Cert:\LocalMachine\Root

Verify it installed correctly:

Get-ChildItem Cert:\LocalMachine\Root | Where-Object { $_.Subject -like "*Morante*" }
Note: Android 7.0+ requires manual installation through System Settings.
  1. Download the Root CA Certificate on your device.
  2. Verify: Open the downloaded file with the Certificate Installer. Select View Details and confirm the SHA-256 fingerprint matches: 22:D0:7A:03:34:54:96:EA:9D:C3:EE:76:7C:99:11:17:E3:55:40:5C:AB:8D:13:E9:8D:19:24:74:EF:02:96:CE
  3. Install:
    • Go to Settings → Security → Encryption & credentials
    • Tap Install a certificate → CA certificate
    • Select the downloaded alt_ca-morante_root.crt
    • If a warning appears, tap Install Anyway
Note: Some Android versions display "Your network may be monitored" after installing a user CA. This is a standard system message and does not indicate any issue.
Important: You must complete all three steps for the certificate to work on iOS.
  1. Download: Tap to download the Root CA Profile. When prompted, tap Allow.
  2. Verify fingerprint:
    • Go to Settings → Profile Downloaded
    • Tap More Details
    • Under FINGERPRINTS, confirm SHA-256 matches: 22d0 7a03 3454 96ea 9dc3 ee76 7c99 1117 e355 405c ab8d 13e9 8d19 2474 ef02 96ce
  3. Install & Trust:
    • Tap Install (top-right). Enter passcode and confirm.
    • Go to Settings → General → About → Certificate Trust Settings
    • Toggle Pacy World Root CA to ON