Re:Startcom CA applies for inclusion in Mozilla
by solatic on Tuesday August 01, 2017 @11:20AM
(#14901599)
Is there an extension like Noscript, but for CA certificates? In the same way which Noscript blocks JavaScript by default, but allows me to gradually build a whitelist of domains which I agree to run JavaScript from, is there an extension which doesn't trust any of the included CAs by default, and allows me to gradually enable CA certificates over time, so that my trust store is composed mainly of easy-to-trust CAs like Let's Encrypt and doesn't include dodgy CAs operating out of China?
[ Parent
| on HN ]
Re:Startcom CA applies for inclusion in Mozilla
by Ajedi32 on Tuesday August 01, 2017 @12:22PM
(#14902383)
Not sure about an extension, but you could always just remove all root certs from your trust store and then add them back one-by-one manually.
Re:Startcom CA applies for inclusion in Mozilla
by cm2187 on Tuesday August 01, 2017 @01:35PM
(#14903227)
Keeping in mind it has all sorts of side effects (signed drivers, etc).
Re:Startcom CA applies for inclusion in Mozilla
by baby on Tuesday August 01, 2017 @07:58PM
(#14906645)
Not if you remove certs from your browser trust store. If I understand correctly a browser has no obligation to follow your OS trust store. If someone here knows, what browser actually trust OS certificates in addition to its own trust store?
Re:Startcom CA applies for inclusion in Mozilla
by cm2187 on Wednesday August 02, 2017 @01:49AM
(#14908214)
Chrome and IE on windows I believe.
Re:Startcom CA applies for inclusion in Mozilla
by syncsynchalt on Tuesday August 01, 2017 @12:57PM
(#14902824)
You'll also need an explicit blacklist, since my understanding is that several CAs cross-sign to get support on older browsers.