0

I would like to know if there is a way to only trust a CA only when a specific domain is being accessed, eg. wikipedia.org. I'm using Chrome, and I'm not really tech savvy so the simpler the solution the better. I'm the end user and not the owner of a website.

Thank you!

1
  • 2
    Browser don't have the ability to select the trusted CA based on the target domain. They might be able restrict which CA can be used to sign a certificate with the predefined certificate pinning, but it is not possible to provide additional CA only for specific domain. Your question is asking about a specific technical detail though and one might be better able to help you if you provide the broader problem you are trying to solve. May 21 at 12:57

1 Answer 1

0

From your question, it seems as though you trust the certificate for the site that you want to visit, but you don't trust the CA that issued the certificate.

In that case, the following procedure will allow you to visit the site, without trusting the CA:

First, remove the CA's certificate from Chrome's trust store.

Then, surf to the site. Chrome will refuse to connect to the site, and show a certificate warning, with a cert_authority_invalid error, like so:

enter image description here

Click 'advanced', then select the option to 'proceed anyway'.

This will prevent Chrome from showing the above warning on subsequent visits to the site. The address bar will show 'not secure', because the certificate does not chain up to a trusted root certificate in the browser's trust store. However the browser's connection to the server will be via TLS using the untrusted certificate.

If you visit another site with a certificate issued by the CA, Chrome will refuse to connect to the site, and show the above certificate warning.

3
  • This will only trust the specific certificate for this site, but not the CA. If a new certificate for the same site gets issued by the same CA it will not be trusted but result in the warning again. May 21 at 13:56
  • @SteffenUllrich, thanks for pointing this out. Yes, OP would have to repeat this procedure whenever the site renews its certificate.
    – mti2935
    May 21 at 13:57
  • This should have included instructions on manually comparing the issuer fingerprint on the certificate with the known CA. As written now, the user ends up accepting just any certificate. May 24 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.