1

Considering that there is no way to actually see which certs that I use in my regularly-visited websites, I've decided to disable all certs and re-enable them on a case by case basis. This is for the dual goal of increasing security and also to familiarize myself with which CAs to trust. If China Internet Network Information Center is suddenly signing my certificate chain down to Gmail, I would like to know! Firefox as shipped by Ubuntu does in fact come with that CNNIC cert preinstalled.

Now that I've disabled all the CAs, when I try to connect to https://example.com Firefox correctly informs me that the connection is untrusted. However, I see no way to look at the cert to determine which CA to reenable. When certs are enabled one can click the Firefox Lock Icon and see the cert, but with the CA used by the cert disabled there seems to way to see the cert. I'm sure that I could script Python and Curl to reveal the cert details but I would prefer something from within Firefox itself. Does Firefox has a way to show to the user certs that do no have a corresponding CA enabled? It seems like a glaring oversight if it doesn't.

In the following screenshot it can be seen that the I Understand the Risks section to open the Certificate Viewer is not available for certs whose root CA is disabled:

enter image description here

TLDR: How to see the name of the root CA (which I need to re-enable) of a cert that Firefox does not recognize, from within Firefox itself?

5

AIA chasing?

TLDR: How to see the root CA of a cert that Firefox does not recognize, from within Firefox itself?

You don't directly get to see the root CA. But you may be able to see the immediately superior CA.

Some certificates (all?) have an Authority Information Access field that allows a certificate to answer the Who's your daddy? question.

(To get to the Certificate Viewer window navigate like this: I Understand the Risks | Add Exception... | View... | Details)

Screenshot of AIA field in Firefox Certificate Viewer

In the case of example.com it's this: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt

Top 15 Root CAs to get you started

Here's the top 15 root CAs from a scan of the Alexa Top 1 Million (2015-10 by Hubert Kario):

Root CAs                                      Count     Percent
---------------------------------------------+---------+-------
(d6325660) COMODO RSA Certification Authority 113492    20.662
(2c543cd1) GeoTrust Global CA                 107601    19.5895
(eed8c118) COMODO ECC Certification Authority 48977     8.9166
(cbf06781) Go Daddy Root Certificate Authorit 47939     8.7276
(5ad8a5d6) GlobalSign Root CA                 44123     8.0329
(b204d74a) VeriSign Class 3 Public Primary Ce 29359     5.345
(244b5494) DigiCert High Assurance EV Root CA 25999     4.7333
(2e4eed3c) thawte Primary Root CA             23372     4.255
(157753a5) AddTrust External CA Root          20188     3.6754
(653b494a) Baltimore CyberTrust Root          12053     2.1943
(ae8153b9) StartCom Certification Authority   9139      1.6638
(fc5a8f99) USERTrust RSA Certification Author 8775      1.5975
(3513523f) DigiCert Global Root CA            8281      1.5076
(4bfab552) Starfield Root Certificate Authori 8226      1.4976
(480720ec) GeoTrust Primary Certification Aut 5570      1.0141

Miscellaneous

Certificate Patrol Addon?

Have you tried the Firefox Certificate Patrol addon? Seems up your alley.

EDIT2015-12-03: Why does this not work for Wikipedia? HSTS!

I guess this does not work for Wikipedia, because wikipedia.orgis HSTS preloaded in Firefox (archived here).

And the "I understand the Risks" button is missing because for HSTS errors a "no user recourse" rule is enforced. This is by design.

  • Thank you. The problem is that the Certificate Viewer is not available for certs whose root CA is disabled, that is the whole premise of the issue. I'll make that clearer in the OP. Thanks. – dotancohen Dec 2 '15 at 14:41
  • 1
    @dotancohen: Try this: I Understand the Risks | Add Exception... | View... | Details -- This works for me on https://www.cacert.org/ and I don't have their root CA trusted. – StackzOfZtuff Dec 2 '15 at 14:46
  • The I Understand the Risks button is absent when the root cert is disabled. I'll make that explicit in the OP. Thank you. – dotancohen Dec 2 '15 at 14:56
  • @dotancohen Note that the "I Understand the Risks" is not a button but a section that you can expand. I have verified in Firefox 42 and it is still avaialbe for disabled CAs. – billc.cn Dec 2 '15 at 15:35
  • Right, I'm familiar with the section as I see it often enough fixing botched Apache configurations! It certainly is not present on my Firefox 42.0 on Kubuntu 15.10 when disabling the site's root cert. I'll add a screenshot. Thank you. – dotancohen Dec 2 '15 at 15:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.