This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read:
In some related questions some users comment that:
- "They wouldn't necessarily have to present untrusted certificates. Suborning an existing Root CA is trivial; as they are businesses like any other. Some countries like Spain, France, China, Japan, Taiwan and Turkey already have their government root ca installed on your computer. A regime could easy require all computers sold or maintained in their country to install their government's root ca."
Besides that, there is an issue with:
- "With another valid TLS leaf certificate the CA flag can be bypassed and that certificate used to sign a certificate for any site.
Chrome and Firefox are certainly vulnerable to this on unpatched systems (which is likely a lot of systems today)."
So, 3 questions:
From point 1), if you live in those countries, with "spain...etc", if there anyway to check that the CA you are using (in firefox for example or other) is the proper company , for example google/gmail? and not the goverment one?
From point 2) how do you we know that we have our browser/system not patched for that kind of bug?
In summary, from previous points WHERE and how should check my CA fingerprint from Gmail.
I have this:
I checked here.
Is this correct?