Considering that there is no way to actually see which certs that I use in my regularly-visited websites, I've decided to disable all certs and re-enable them on a case by case basis. This is for the dual goal of increasing security and also to familiarize myself with which CAs to trust. If China Internet Network Information Center is suddenly signing my certificate chain down to Gmail, I would like to know! Firefox as shipped by Ubuntu does in fact come with that CNNIC cert preinstalled.
Now that I've disabled all the CAs, when I try to connect to https://example.com
Firefox correctly informs me that the connection is untrusted. However, I see no way to look at the cert to determine which CA to reenable. When certs are enabled one can click the Firefox Lock Icon and see the cert, but with the CA used by the cert disabled there seems to way to see the cert. I'm sure that I could script Python and Curl to reveal the cert details but I would prefer something from within Firefox itself. Does Firefox has a way to show to the user certs that do no have a corresponding CA enabled? It seems like a glaring oversight if it doesn't.
In the following screenshot it can be seen that the I Understand the Risks
section to open the Certificate Viewer is not available for certs whose root CA is disabled:
TLDR: How to see the name of the root CA (which I need to re-enable) of a cert that Firefox does not recognize, from within Firefox itself?
curl -v
shows issuer for the server/leaf cert but in practice today that is almost never the root. For OpenSSL and Java, see stackoverflow.com/questions/27244751/… . – dave_thompson_085 Dec 3 '15 at 3:21