# remove-cnnic-root-ca-certificate.pp (only tested on ubuntu 14.04) file { 'CNNIC_ROOT.crt': path => '/usr/share/ca-certificates/mozilla/CNNIC_ROOT.crt

# remove-cnnic-root-ca-certificate.pp (only tested on ubuntu 14.04) file { 'CNNIC_ROOT.crt': path => '/usr/share/ca-certificates/mozilla/CNNIC_ROOT.crt', ensure => absent, } file { '895cad1a.0': path => '/etc/ssl/certs/895cad1a.0', ensure => absent, } file { 'bd1910d4.0': path => '/etc/ssl/certs/bd1910d4.0', ensure => absent, } file { 'CNNIC_ROOT.pem': path => '/etc/ssl/certs/CNNIC_ROOT.pem', ensure => absent, } (N.B.: Yes, I know that doesn't completely take care of the problem. I manually "distrusted" it in Chromium and Firefox as well.)