4 ms·
Is there an extension like Noscript, but for CA certificates? In the same way which Noscript blocks JavaScript by default, but allows me to gradually build a wh
by solatic 9y ago
Is there an extension like Noscript, but for CA certificates? In the same way which Noscript blocks JavaScript by default, but allows me to gradually build a whitelist of domains which I agree to run JavaScript from, is there an extension which doesn't trust any of the included CAs by default, and allows me to gradually enable CA certificates over time, so that my trust store is composed mainly of easy-to-trust CAs like Let's Encrypt and doesn't include dodgy CAs operating out of China?
- jgworks 9y agoI'd love to see this, with the added ability to whitelist specific SSL certs like ssh does with host keys.
- Ajedi32 9y agoNot sure about an extension, but you could always just remove all root certs from your trust store and then add them back one-by-one manually.
- cm2187 9y agoKeeping in mind it has all sorts of side effects (signed drivers, etc).
- baby 9y agoNot if you remove certs from your browser trust store. If I understand correctly a browser has no obligation to follow your OS trust store. If someone here knows, what browser actually trust OS certificates in addition to its own trust store?
- cm2187 9y agoChrome and IE on windows I believe.
- syncsynchalt 9y agoYou'll also need an explicit blacklist, since my understanding is that several CAs cross-sign to get support on older browsers.