I recently installed the Light (a more compact forking of Firefox).
I started getting the "This Connection is Untrusted" error, which got me wondering: when should I add an exception to the list of trusted certificates? Yes, this gets at the issue of trust, and that is an enormous problem in itself. But let us suppose that I felt comfortable trusting the certificates that came bundled in my browser (whether it be Firefox, Light, or IE)
In my case, the error is (Error code: sec_error_unknown_issuer). It must be that Light doesn't have the full list of trusted authorities that the full Firefox does.
I can see the certificate in question, and I can see the name of the issuer of the certificate (in my case, Starfield Secure Certificate Authority - G2). And yes, if I go to the big Firefox list of trusted certificates, I can see similar names there (Starfield Services Root Certificate Authority - G2, and Starfield Root Certificate Authority - G2), although not an exact match.
But I imagine that is not enough: it is not an exact match. But let us go further: let us assume that the name of the issuer were a perfect a match. Presumably, if a website is trying to steal my information, or run malicious code in my browser, it will be smart enough to fake the name of a trusted certificate provider. What is it in the certificate itself that I must verify to make sure that the certificate that I am being presented is authentic, and there is not some bozo somewhere faking a trusted certificate? And, is there a way to get that authentic certificate from the horse's mouth, so to speak, instead of from the webpage I am currently trying to browse?