Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After the disaster with diginotar I want to remove all existing root CAs from my Google Chrome installation. Can I delete the pre-installed root CA settings somehow?

The settings dialog doesn't allow me to remove it at the moment:

enter image description here

share|improve this question
Everyone has updated their root certificate stores to remove DigiNotar. You are over reacting and what you want to do will have the opposite effect. – Moab Oct 8 '11 at 15:09
Penny wise, pound foolish. . . – surfasb Oct 8 '11 at 22:48
up vote 4 down vote accepted

On Linux, the certificates are kept in a read-only database, and would reappear on upgrading Chromium. However, you can mark them as untrusted, since the trust bits are stored separately as user preferences. Just click Edit... (Bearbeiten...) and disable all three trust bits.

However, keep in mind what @nkvp and others have said – this will make you less secure, since there will be no way for you to verify any certificate even if the CA in question is perfectly secure. Unfortunately, neither Perspectives nor Convergence are available for Chrome yet, so you would be left in doubt 100% of the time.

share|improve this answer
Thanks for this reply. – cringe Oct 9 '11 at 6:46

It is not wise to remove all existing root CAs since it will be very difficult to identify trustworthy sites from that with fake certificates ( all ssl certs will become untrusted so warnings will be generated for all certificates),

Thus man-in-the-middle attacks will be easy since the user will most probably not be able to find if the certificates presented by the site is fake.

share|improve this answer
So there is no way to remove the CAs? – cringe Oct 8 '11 at 11:36
@cringe: There is a way. Stop using HTTPS. Boom, no CAs needed. – surfasb Oct 8 '11 at 22:47

Chrome uses the Windows SSL store, so you just need to delete them from Internet Options in windows.

I'd like to reiterate what has been said in the comments. This is a fundamentally stupid thing to do, as you will have no way of verifying any site is legitimate, unless you manually check each certificate. It isn't enough to view them, you need to ensure the public key for the CA is correct.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .