How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL?

On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly distrusted). In this way, say we we have

  Verisign --->  Some_CA_I_dont_trust ---> ... ---> Some Site

I can remove trust of Some_CA_I_dont_trust without affecting others from Verisign.

However, it doesn't seem to be the case if I add a ! to the corresponding line in /etc/ca-certificates.conf and execute update-ca-certificates. OpenSSL happily accept the certificate even though intermediate CA is not on my system.


By trusting the Root CA you're trusting their judgement in who they sign. As long as the intermediate CA is valid, not revoked, and you're trusting the Root CA... the chain will always be verified. Other applications (such as FireFox) can add additional checks and functionality to check for untrusted intermediate certificates, but unless the application provides it it's not really part of the SSL/TLS specification.

To remove trusted root CAs you can perform the following:

update-ca-certificates updates /etc/ssl/certs by reading the /etc/ca-certicates.conf. /etc/ca-certificates.conf is autogenerated by running sudo dpkg-reconfigure ca-certificates.

This will bring up a command GUI.

  1. At the first prompt you have the option to say Yes/No/Ask for new certificates. Click Ask
  2. Now you'll be given a huge list of CAs with a * next to them. Go down the list and remove the CAs you want by pressing spacebar. The * will be removed.
  3. When you're done press Enter.
  4. This should trigger the updating of /etc/ssl/certs. The CAs you've removed should be listed at the command prompt.

If you don't see something like this:

Processing triggers for ca-certificates ...
Updating certificates in /etc/ssl/certs... 0 added, 1 removed; done.
Running hooks in /etc/ca-certificates/update.d....
Removing debian:A-Trust-nQual-03.pem

Then I would then run sudo update-ca-certificates to ensure that /etc/ssl/certs is updated appropriately.

I performed all of this on a Debian based system.

| improve this answer | |
  • Are you sure removing a certificate like this is the same as not trusting it? I tested it out and it looks as if adding a ! is the same as removing the certificate itself. Even if the CA's certificate is removed, it's still verified as intermediate, which is exactly what I'm trying to avoid. – phoeagon Feb 26 '15 at 14:08
  • Are you removing this on a client or server? How are you attempting to verify the connection? – RoraΖ Feb 26 '15 at 14:31
  • I'm going to do this on clients (preferably in a scalable way). I'm verifying it with openssl verify and wget (FF & Chrome use NSS). The thing is, if a CA is Root-CA, I can remove it by disabling it in /etc/ca-certificates.conf. But if it's not.... – phoeagon Feb 26 '15 at 14:38
  • Can you post the command you're using for the openssl verify? – RoraΖ Feb 26 '15 at 14:44
  • I tried openssl verify -purpose [p] *.crt whereas [p] is anything with "-sign". It passes when purpose is either any or *sign. I also use wget https://website-that-uses-cert-from-that-ca.com and wget happily accept the EE certificate signed by the CA. – phoeagon Feb 26 '15 at 14:51

I don't think you could do this with the usual applications..

If you have your own application using the OpenSSL library you could handle this condition inside the certificate verify_callback. This callback is called on verification for each certificate in the trust chain and you can distrust the certificate by just returning 0. Note that this will cause the complete verification to fail, even if their would be an alternative trust path which does not use the distrusted certificate.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.