After the disaster with diginotar I want to remove all existing root CAs from my Google Chrome installation. Can I delete the pre-installed root CA settings somehow?
The settings dialog doesn't allow me to remove it at the moment:
-
2Everyone has updated their root certificate stores to remove DigiNotar. You are over reacting and what you want to do will have the opposite effect.– MoabOct 8, 2011 at 15:09
-
Penny wise, pound foolish. . .– surfasbOct 8, 2011 at 22:48
Add a comment
|
3 Answers
On Linux, the certificates are kept in a read-only database, and would reappear on upgrading Chromium. However, you can mark them as untrusted, since the trust bits are stored separately as user preferences. Just click Edit... (Bearbeiten...) and disable all three trust bits.
However, keep in mind what @nkvp and others have said – this will make you less secure, since there will be no way for you to verify any certificate even if the CA in question is perfectly secure. Unfortunately, neither Perspectives nor Convergence are available for Chrome yet, so you would be left in doubt 100% of the time.
answered Oct 8, 2011 at 12:23
It is not wise to remove all existing root CAs since it will be very difficult to identify trustworthy sites from that with fake certificates ( all ssl certs will become untrusted so warnings will be generated for all certificates),
Thus man-in-the-middle attacks will be easy since the user will most probably not be able to find if the certificates presented by the site is fake.
-
-
1
Chrome uses the Windows SSL store, so you just need to delete them from Internet Options in windows.
I'd like to reiterate what has been said in the comments. This is a fundamentally stupid thing to do, as you will have no way of verifying any site is legitimate, unless you manually check each certificate. It isn't enough to view them, you need to ensure the public key for the CA is correct.
