4 ms·

How to disable CAs on firefox (thanks user nmc): The GUI way: https://wiki.mozilla.org/CA:UserCertDB#Deleting_a_Root_Certificate https://wiki.mozilla.org/CA:Us

by VMG 10y ago

How to disable CAs on firefox (thanks user nmc): The GUI way: https://wiki.mozilla.org/CA:UserCertDB#Deleting_a_Root_Certificate https://wiki.mozilla.org/CA:UserCertDB#Deleting_a_Root_Certi... The CLI way: http://unix.stackexchange.com/a/285831 http://unix.stackexchange.com/a/285831 Chrome/Chromium: search "certificate" in settings to get to the certificate manager, edit trust settings for certificates.

imglorp 10y ago
How can laypeople know which certs can currently be trusted? Is there a list of ratings somewhere, or maybe a whitelist of some kind?
- svenfaw 10y ago
  I'm working on such a project. The ratings are based on a few well-defined criteria. Stay tuned!
  - rocqua 10y ago
    How do I stay tuned? Sounds quite interesting.
  - joepie91_ 10y ago
    Potentially useful to that end: https://git.cryto.net/joepie91/ca-incidents https://git.cryto.net/joepie91/ca-incidents
mtgx 10y ago
Don't forget to disable them in Android (and iOS?), too.
- kuschku 10y ago
  Remember that editing the root CA store is not possible on Android Nougat anymore, to prevent MitM proxies for adblocking or debugging apps you didn't develop.
  - josteink 10y ago
    > not possible on Android Nougat anymore, to prevent MitM proxies for adblocking or debugging apps you didn't develop That certainly makes the Nougat taste a bit sour. And Chrome doesn't even support ad block on mobile. Let's hope Firefox gets its act back together.
    - kuschku 10y ago
      Btw, more info: https://news.ycombinator.com/item?id=12061320 https://news.ycombinator.com/item?id=12061320
  - pfg 10y ago
    It's still possible to remove CA certificates from the trust store on Android Nougat. It's also possible to use custom CAs for apps that explicitly opt into trusting custom CAs.
nmc 10y ago
You are certainly welcome.
alcari 10y ago
Be aware that there are known issues with the certificate manager, and some changes may not work as you expect: https://bugzilla.mozilla.org/show_bug.cgi?id=585352 https://bugzilla.mozilla.org/show_bug.cgi?id=585352

by VMG 10y ago

imglorp 10y ago

How can laypeople know which certs can currently be trusted? Is there a list of ratings somewhere, or maybe a whitelist of some kind?

svenfaw 10y ago
I'm working on such a project. The ratings are based on a few well-defined criteria. Stay tuned!
- rocqua 10y ago
  How do I stay tuned? Sounds quite interesting.
- joepie91_ 10y ago
  Potentially useful to that end: https://git.cryto.net/joepie91/ca-incidents https://git.cryto.net/joepie91/ca-incidents

mtgx 10y ago

Don't forget to disable them in Android (and iOS?), too.

kuschku 10y ago
Remember that editing the root CA store is not possible on Android Nougat anymore, to prevent MitM proxies for adblocking or debugging apps you didn't develop.
- josteink 10y ago
  > not possible on Android Nougat anymore, to prevent MitM proxies for adblocking or debugging apps you didn't develop That certainly makes the Nougat taste a bit sour. And Chrome doesn't even support ad block on mobile. Let's hope Firefox gets its act back together.
  - kuschku 10y ago
    Btw, more info: https://news.ycombinator.com/item?id=12061320 https://news.ycombinator.com/item?id=12061320
- pfg 10y ago
  It's still possible to remove CA certificates from the trust store on Android Nougat. It's also possible to use custom CAs for apps that explicitly opt into trusting custom CAs.

nmc 10y ago

You are certainly welcome.

alcari 10y ago

Be aware that there are known issues with the certificate manager, and some changes may not work as you expect: https://bugzilla.mozilla.org/show_bug.cgi?id=585352 https://bugzilla.mozilla.org/show_bug.cgi?id=585352