3 ms·

Thanks for the reminder to recheck my certs. I manually wiped CNNIC (among others) when the news first broke, and with today's Firefox update, I'll check again

Thanks for the reminder to recheck my certs. I manually wiped CNNIC (among others) when the news first broke, and with today's Firefox update, I'll check again.

Laforet 12y ago
You can't just "wipe" a Root CA on Windows - you have to explicitly untrust it.
- yuhong 12y ago
  Open certmgr.msc and put the certificate into the "Untrusted Certificates" store.
  - zaroth 12y ago
    I don't remember deleting it, but also can't find one that seems to be from CNNIC. Does anyone keep a list of ones they personally like to mark as Untrusted, which doesn't break [too many] sites?
    - svenfaw 12y ago
      Look for "China Internet Network Information Center EV Certificates Root" and "China Internet Network Information Center (CNNIC)" (thumbprints 4F99AA93FB2BD13726A1994ACE7FF005F2935D1E and ‎8baf4c9b1df02a92f7da128eb91bacf498604b6f)
    - mike_hearn 12y ago
      Windows downloads root certs just in time.
      - zaroth 12y ago
        Yes, of course! So now I need to figure out how I can add a thumbprint to a Untrusted Cert store...
      - unluckier 12y ago
        And why exactly do they do this?