By trusting the Root CA you're trusting their judgement in who they sign. As long as the intermediate CA is valid, not revoked, and you're trusting the Root CA... the chain will always be verified. Other applications (such as FireFox) can add additional checks and functionality to check for untrusted intermediate certificates, but unless the application provides it it's not really part of the SSL/TLS specification.
To remove trusted root CAs you can perform the following:
/etc/ssl/certs by reading the
/etc/ca-certificates.conf is autogenerated by running
sudo dpkg-reconfigure ca-certificates.
This will bring up a command GUI.
- At the first prompt you have the option to say Yes/No/Ask for new certificates. Click Ask
- Now you'll be given a huge list of CAs with a
* next to them. Go down the list and remove the CAs you want by pressing
* will be removed.
- When you're done press
- This should trigger the updating of
/etc/ssl/certs. The CAs you've removed should be listed at the command prompt.
If you don't see something like this:
Processing triggers for ca-certificates ...
Updating certificates in /etc/ssl/certs... 0 added, 1 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Then I would then run
sudo update-ca-certificates to ensure that
/etc/ssl/certs is updated appropriately.
I performed all of this on a Debian based system.