My Situation :
I've setup my own certificate authority, and generated a certificate for a server used primarily internally.
As I understand it, I can configure my browsers/computers to trust the certificate of the internal server by importing the cert of the higher authorities.
My Concern :
How can I be made aware (before I submit sensitive info to the rogue server or MITM device) of any attack whereby a pre-trusted authority is used to generate a new certificate for an imposter server ?
Can I configure my browser (Chrome, Firefox) to throw an alert if the certificate issuer / fingerprint changes ?
In short, how can I untrust trusted authorities on a per-domain basis ?