3 ms·

Is there an easy way for me to revoke trust from all Chinese CAs? Anyone in China is ultimately subject to being forced to do the dirty work of the Chinese Comm

Is there an easy way for me to revoke trust from all Chinese CAs? Anyone in China is ultimately subject to being forced to do the dirty work of the Chinese Communist Party. Why are browser and OS vendors even trusting them in the first place?

aianus 10y ago
I untrusted all Chinese-sounding CAs from "System Roots" under "Keychain Access" in OSX as soon as I got my laptop. That's what Chrome and Safari verify against.
- Kadin 10y ago
  That wouldn't have helped you in this case -- WoSign doesn't even show up in the OS X or Windows root keystores. Its certificates are (apparently) signed by StartCom. I just blacklisted StartCom's root certs. IMO for signing off on WoSign they're just as guilty, if not worse, than WoSign itself. Since they're the ones with the root cert in the OS, the buck stops there.
  - aianus 10y ago
    Yup, you're absolutely right. I've also blacklisted StartCom after reading through the comments on this thread.
  - rblatz 10y ago
    I attempted to remove all StartCom certs from the OS X keychain, apparently you can't do it even as root. You have to boot into the recovery partition first. http://superuser.com/questions/1070664/security-seckeychainitemdelete-unixoperation-not-permitted-on-os-x-when-tryi http://superuser.com/questions/1070664/security-seckeychaini... Edit: Don't delete them, instead right click each certificate, select "Get Info", Expand the "Trust" panel, and set it to "Never Trust"
    - aianus 10y ago
      You don't have to remove them, you can just set the 'Trust' setting to 'Never Trust'.
      - joosters 10y ago
        I can't remember whether it was MacOS or Windows, but at least one OS will sometimes re-install a 'standard' CA certificate if you delete it. Setting 'never trust' is the most reliable way to kick out the CA as it ensures that it stays out.
      - rblatz 10y ago
        Thanks! I assumed that was an option I just didn't see it at first.
mlvljr 10y ago
And look, how they immediately dispatched an army of downvoting trolls to hide your comment!

aianus 10y ago

I untrusted all Chinese-sounding CAs from "System Roots" under "Keychain Access" in OSX as soon as I got my laptop. That's what Chrome and Safari verify against.

Kadin 10y ago
That wouldn't have helped you in this case -- WoSign doesn't even show up in the OS X or Windows root keystores. Its certificates are (apparently) signed by StartCom. I just blacklisted StartCom's root certs. IMO for signing off on WoSign they're just as guilty, if not worse, than WoSign itself. Since they're the ones with the root cert in the OS, the buck stops there.
- aianus 10y ago
  Yup, you're absolutely right. I've also blacklisted StartCom after reading through the comments on this thread.
- rblatz 10y ago
  I attempted to remove all StartCom certs from the OS X keychain, apparently you can't do it even as root. You have to boot into the recovery partition first. http://superuser.com/questions/1070664/security-seckeychainitemdelete-unixoperation-not-permitted-on-os-x-when-tryi http://superuser.com/questions/1070664/security-seckeychaini... Edit: Don't delete them, instead right click each certificate, select "Get Info", Expand the "Trust" panel, and set it to "Never Trust"
  - aianus 10y ago
    You don't have to remove them, you can just set the 'Trust' setting to 'Never Trust'.
    - joosters 10y ago
      I can't remember whether it was MacOS or Windows, but at least one OS will sometimes re-install a 'standard' CA certificate if you delete it. Setting 'never trust' is the most reliable way to kick out the CA as it ensures that it stays out.
    - rblatz 10y ago
      Thanks! I assumed that was an option I just didn't see it at first.

mlvljr 10y ago

And look, how they immediately dispatched an army of downvoting trolls to hide your comment!