There are lots of strange looking Certificate Authorities in my keychain as well as Firefox. I am sure they are legitimate CAs (as they are the same on my Mac and PC and other computers I checked). And by strange I mean they seems to be specific to same other countries or organizations that I am sure I have nothing to do with, is there a way to safely remove these unnecessary CAs? Is there a list for regular US users or a way to disable them and enable them when they ar needed?
The Web is worldwide. That you are a "US user" does not mean that you will only look at US websites.
You can remove any CA certificate that you do not wish to trust. That's your prerogative. The only consequence of removing a CA certificate is that the machine will cease to automatically accept as valid any certificate issued by the said CA. Translation: some HTTPS Web site may begin to trigger scary warnings, which you can always bypass, but which are scary nonetheless (and training yourself to bypass scary warnings might not be a good idea anyway).
The truth is that, as a user, you have very little information on which you could base your decision of trusting or not trusting any particular CA. Ideally, you would trust only those CA for which you can establish a clear responsibility path down to you: the CA which will give you a lot of money in case you get swindled due to a mistake made by the CA. However, there is no such CA. Instead, what you have is a list of "default CA" who made a deal with the OS vendor (Apple, in the case of Mac OS) so that the OS vendor accepts to include them as "default CA". These CA, and Apple, are way too smart, legally speaking, to give you money in case of any problem (as a Mac user, your money relationship with Apple rather flows in the other direction). Yet, if one of the "default CA" begins to behave improperly, that's Apple public image which is at stake.
So my advice would be to let things as they are. This is what almost everybody does. Remember that, in any case, the point of the CA is to validate the certificate, which does not mean that the corresponding site is maintained by honest and trustworthy people; the only thing that the CA guarantees is that the Web page you are looking at really came from the Web site whose name is in the URL bar.
You don't require them : it's just a legacy habbit. Take a look at Project Perspectives
The set of https connections you will encounter breaks down into two disjoint subsets:
- Those you care about: financial sites, email, work, cloud storage for your backups … any site where a compromised connection will cost you money, data, time, aggravation, compromise of other sites (the main reason email is on the list — password resets), etc.
- Those you don’t care about: most of the sites out there, where security is not an issue and they could just as easily use plain http for all you care.
For those you care about, you can click on the padlock icon in the address bar and see what CA is certifying this connection. You can even dig into the algorithms used, the dates of the certificates, and many other details, if you’re interested.
For those you don’t care about, well, you don’t care! Session’s been hijacked? Some CA controlled by an unpleasant government is messing with you? So what? There’s no security issue and it doesn’t matter.
So it really doesn’t matter if all those CAs are there. When it counts, you can easily make sure that your connection is certified by a CA that you trust. The presence of all those others is irrelevant.