Is there a list of known deprecated/unsafe certificate authorities?

Question

Is there a list of known deprecated/unsafe certificate authorities (CAs)?

For example:

1. TurkTrust
2. DigiNotar

Are there other "trusted" CAs that should not be or are not trusted (by browsers anymore) and why? Or better is there a list with such CAs?

Answer 1

Since anyone could stand up a new CA that wouldn't be trusted, you may be better off just taking the union (or perhaps intersection) of the CAs trusted by the major browser vendors.

That said, you can probably get the information you asked for from a combination of the following sources:

• https://aka.ms/rootupdates
• https://blog.mozilla.org/security/category/ca-program/
• https://www.chromium.org/Home/chromium-security/root-ca-policy
• https://support.apple.com/en-us/HT207177
• Custom search of Mozilla's bug database