How to determine which Browser Certs to reenable on a per-case basis?

Question

Considering that there is no way to actually see which certs that I use in my regularly-visited websites, I've decided to disable all certs and re-enable them on a case by case basis. This is for the dual goal of increasing security and also to familiarize myself with which CAs to trust. If China Internet Network Information Center is suddenly signing my certificate chain down to Gmail, I would like to know! Firefox as shipped by Ubuntu does in fact come with that CNNIC cert preinstalled.

Now that I've disabled all the CAs, when I try to connect to https://example.com Firefox correctly informs me that the connection is untrusted. However, I see no way to look at the cert to determine which CA to reenable. When certs are enabled one can click the Firefox Lock Icon and see the cert, but with the CA used by the cert disabled there seems to way to see the cert. I'm sure that I could script Python and Curl to reveal the cert details but I would prefer something from within Firefox itself. Does Firefox has a way to show to the user certs that do no have a corresponding CA enabled? It seems like a glaring oversight if it doesn't.

In the following screenshot it can be seen that the I Understand the Risks section to open the Certificate Viewer is not available for certs whose root CA is disabled:

TLDR: How to see the name of the root CA (which I need to re-enable) of a cert that Firefox does not recognize, from within Firefox itself?

Answer 1

AIA chasing?

TLDR: How to see the root CA of a cert that Firefox does not recognize, from within Firefox itself?

You don't directly get to see the root CA. But you may be able to see the immediately superior CA.

Some certificates (all?) have an Authority Information Access field that allows a certificate to answer the Who's your daddy? question.

(To get to the Certificate Viewer window navigate like this: I Understand the Risks | Add Exception... | View... | Details)

In the case of example.com it's this: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt

Top 15 Root CAs to get you started

Here's the top 15 root CAs from a scan of the Alexa Top 1 Million (2015-10 by Hubert Kario):

Root CAs                                      Count     Percent
---------------------------------------------+---------+-------
(d6325660) COMODO RSA Certification Authority 113492    20.662
(2c543cd1) GeoTrust Global CA                 107601    19.5895
(eed8c118) COMODO ECC Certification Authority 48977     8.9166
(cbf06781) Go Daddy Root Certificate Authorit 47939     8.7276
(5ad8a5d6) GlobalSign Root CA                 44123     8.0329
(b204d74a) VeriSign Class 3 Public Primary Ce 29359     5.345
(244b5494) DigiCert High Assurance EV Root CA 25999     4.7333
(2e4eed3c) thawte Primary Root CA             23372     4.255
(157753a5) AddTrust External CA Root          20188     3.6754
(653b494a) Baltimore CyberTrust Root          12053     2.1943
(ae8153b9) StartCom Certification Authority   9139      1.6638
(fc5a8f99) USERTrust RSA Certification Author 8775      1.5975
(3513523f) DigiCert Global Root CA            8281      1.5076
(4bfab552) Starfield Root Certificate Authori 8226      1.4976
(480720ec) GeoTrust Primary Certification Aut 5570      1.0141

Miscellaneous

Certificate Patrol Addon?

Have you tried the Firefox Certificate Patrol addon? Seems up your alley.

EDIT2015-12-03: Why does this not work for Wikipedia? HSTS!

I guess this does not work for Wikipedia, because wikipedia.orgis HSTS preloaded in Firefox (archived here).

And the "I understand the Risks" button is missing because for HSTS errors a "no user recourse" rule is enforced. This is by design.