3 ms·

I wish I could set my browser into a mode where CAs are an opt-in. I enable this setting and at first I can't go to Google unless I enable Google's CA. The go

• woodruffw 4y ago
  You can't do this directly in your browser, but you can do it with your system certificate store. Lots of people disable these small, low-volume CAs. (I wonder if there's a tool out there that does so automatically? Something like Filippo's mkcert but for automatically pruning the CA store down to just the ~dozen major operators?)
• verytrivial 4y ago
  Exactly this. CA curation. These sort of trade-offs are probably beyond a single entity to assess (arguments about fundamental PKI limitations aside), but I'm certain if there was an API, even just some simplified file format, "the web" could come up with a way to crowd-source better intel on what CAs should and shouldn't be in the list, all the way down to explicitly using only ones you want. A bit like bittorrent blocklists, ye olde spam list, etc.