Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). And by strange I mean they seems to be specific to same other countries or organizations that I am sure I have nothing to do with, is there a way to safely remove these unnecessary CAs? Is there a list for regular US users or a way to disable them and enable them when they ar needed?

share|improve this question
    
Keep in mind a US site can use a cert from a non-US issuer. They aren't geographically restricted. – baconface Jun 14 at 7:35
up vote 13 down vote accepted

The Web is worldwide. That you are a "US user" does not mean that you will only look at US websites.

You can remove any CA certificate that you do not wish to trust. That's your prerogative. The only consequence of removing a CA certificate is that the machine will cease to automatically accept as valid any certificate issued by the said CA. Translation: some HTTPS Web site may begin to trigger scary warnings, which you can always bypass, but which are scary nonetheless (and training yourself to bypass scary warnings might not be a good idea anyway).

The truth is that, as a user, you have very little information on which you could base your decision of trusting or not trusting any particular CA. Ideally, you would trust only those CA for which you can establish a clear responsibility path down to you: the CA which will give you a lot of money in case you get swindled due to a mistake made by the CA. However, there is no such CA. Instead, what you have is a list of "default CA" who made a deal with the OS vendor (Apple, in the case of Mac OS) so that the OS vendor accepts to include them as "default CA". These CA, and Apple, are way too smart, legally speaking, to give you money in case of any problem (as a Mac user, your money relationship with Apple rather flows in the other direction). Yet, if one of the "default CA" begins to behave improperly, that's Apple public image which is at stake.

So my advice would be to let things as they are. This is what almost everybody does. Remember that, in any case, the point of the CA is to validate the certificate, which does not mean that the corresponding site is maintained by honest and trustworthy people; the only thing that the CA guarantees is that the Web page you are looking at really came from the Web site whose name is in the URL bar.

share|improve this answer
2  
In addition to that: let go of the notion that PKI makes things secure automatically, and the CAs are not a problem anymore :-) – chris Sep 13 '11 at 5:59
2  
Someone did an experiment and deleted all but chosen 10 CAs from his browser. He used that setting for a few months and was still able to surf the web like he used to - almost all the sites he visited still worked. I don't remember the details of the experiment though, but it clearly showed that casual web user does not need that many CAs. – Krzysztof Kotowicz Sep 19 '11 at 13:42
    
"the only thing that the CA guarantees is that the Web page you are looking at really came from the Web site whose name is in the URL bar" This is inaccurate since any trusted CA can produce a fraudulent certificate for any domain that will be accepted by the browser. Evil CA can trick your browser into thinking that you're securely connected to amazon.com's server when you could be connected to another (DNS poisoning) and be looking at a fraudulent certificate. – Patrick Jun 14 at 5:50

The set of https connections you will encounter breaks down into two disjoint subsets:

  • Those you care about: financial sites, email, work, cloud storage for your backups … any site where a compromised connection will cost you money, data, time, aggravation, compromise of other sites (the main reason email is on the list — password resets), etc.
  • Those you don’t care about: most of the sites out there, where security is not an issue and they could just as easily use plain http for all you care.

For those you care about, you can click on the padlock icon in the address bar and see what CA is certifying this connection. You can even dig into the algorithms used, the dates of the certificates, and many other details, if you’re interested.

For those you don’t care about, well, you don’t care! Session’s been hijacked? Some CA controlled by an unpleasant government is messing with you? So what? There’s no security issue and it doesn’t matter.

So it really doesn’t matter if all those CAs are there. When it counts, you can easily make sure that your connection is certified by a CA that you trust. The presence of all those others is irrelevant.

share|improve this answer
    
Not caring about the security of a site should not lead you to conclude that you don't care whether the CA used for that site is trustworthy. A shady CA could manufacture a fraudulent certificate for the sites that you do care about (bank) and hurt you; you'd have no way to tell that this time you're not really connected to bank.com, but to a man-in-the-middle (no user can be reasonably expected to dig into certificate details every time he visits every important site). So the concern about the proliferation of CAs is valid. – Patrick Jun 14 at 5:57

You don't require them : it's just a legacy habbit. Take a look at Project Perspectives

share|improve this answer

You are lucky if you can identify which CA you could turn off or disable. Mostly letting it as is, is the best way to avoid any unnecessary problems for which you could encounter in the future if you disabled some CA.

If you are worried for any virus or alike, improve or get some good antivirus.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.