2

There are so many CAs in firefox, that are impossible to approve the reliability of all of them.

How do I remove all CAs but the biggest ones like Lets Encrypt, Google Trust Services, GlobalSign and DigiCert?

Maybe wqith an addon?

1

1 Answer 1

2

Go to about:preferences#privacy, scroll down to the bottom under "Certificates", click "View Certificates", then go to the "Authorities" tab.

Select each certificate authority you want to distrust, then click the "Delete or Distrust" button.

Firefox CA trust screen

There doesn't appear to be a simple way to restore trust in a built-in CA, so you may want to be extra careful in distrusting built in CAs - in particular, not all well known CAs have well known issuer names: "Let's Encrypt", for example, is issued by "Internet Security Research Group", so distrusting the "ISRG Root X1" certificate would distrust "Let's Encrypt" (well, they're cross-signed, so would keep working unless you also distrusted IdenTrust, which also doesn't sound like it's related...).

You need to decide what counts as untrustworthy for your use case - if you need to deal with the Finnish government, say, you need TeliaSonera. If you don't, and you don't need any other sites using certs signed by it, you probably don't.

The options are basically:

  • decide which CAs you trust, and remove all others, living with breakage of sites signed by other CAs,
  • or work out what sites you use rely on, and perform more detailed checking of those CAs until you feel able to trust them, or can replace those sites which rely on them with others using CAs you do trust.
4
  • so do you know a list that you could distrust without such problems?
    – rubo77
    Sep 19, 2018 at 8:00
  • @rubo77 If such a list of "untrustworthy CAs" would exist, then browser vendors could just remove them for all users.
    – Lukas
    Sep 19, 2018 at 8:30
  • See updated answer for reasons why it is a per-user thing
    – Matthew
    Sep 19, 2018 at 9:09
  • So, an add on would be needed where you could specially mark the certificates that you REALLY trust. All others should show a warning sign then
    – rubo77
    Sep 19, 2018 at 20:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .