I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification authorities\certificates.
Is there a way to know if a certificate might be malicious or compromised? Since certificates are so important to security, there should be a way for an admin to be sure that the trusted certificates on user PC are safe or not.
Most of the certificates are updated through whichever update mechanism that is available to the system. You cannot be certain that the certs that are installed with the browser are not effectively used for mitm. On the other hand, you could write a small script that uses openssl client mode to retrieve the x509 certs of SSL based targets and from there do a comparison with the incoming site's signature.
This does not scale very well though. Also you might be aware that, at least of macosx, there is the ocsp client that also functions to revoke x509 certs. The problem is such that once you have a rogue root cert installed in your system, just about everything can be spoofed, which includes downloading of any solution over https. At the very worst, you can download, at least for firefox, the set of certs that are installed in the browser and do a quick corroboration test. But over the same broken system? Boot up in a livecd, possibly ubuntu, and do the downloads that way.
Please hug your poor system administrator that has to confirm whether your certs are in order.
There is no such thing as a safe or unsafe certificate. In that sense all certificates as equal. Certificates are only about trust. When can you trust a certificate?
You could do a thorough investigation to who is behind (who holds the corresponding private key) each of the 36 certificates and do an audit of their policies yourself. Most people however simply trust Microsoft to make an informed decision for the pre-installed certificates.
To make things worse: a browser like Firefox comes with its own set of root certicates so now you have to trust Mozilla as well.
The best you can do is compare that list of certificates to the standard Microsoft list (assuming such a list exists)
