Convergence - If I install it, I can remove the installed CA's in my webbrowser?

Question

After I installed Convergence ( http://convergence.io/ ) Firefox Add-on, I can remove the installed CA's from my webbrowser? Is it true?

Answer 1

Yes, you can remove the CAs from Firefox but it's not necessary to do so. Convergence bypasses them entirely so whether they are present or not won't matter. What matters for Convergence is that the certificate you receive from a website matches the certificate received by the Notary servers for the same website.

You could run a test however.

1. Make sure Convergence is off
2. Go to a site with SSL and view its certificate information
3. Look at the certificate details to find its Root CA (first in the hierarchy likely named "Builtin Object Token etc...")
4. Open Firefox preferences, Advanced, Encryption, View Certificates. In that Certificate Manager go to the Authorities tab.
5. Find the CA from step 3 in the list (you can have both windows open so you're sure)
6. Export the CA to a file.
7. Click "Edit Trust" and note the checkboxes.
8. Now delete/distrust that CA.
9. Refresh the site and you'll get a Untrusted Connection error.
10. Turn Convergence on and the site works again. huzzah
11. To restore the CA, go back into the Preferences and Import the certificate file. If you get an alert that says the certificate is already installed (like you will for a Builtin), find it in the list and click "Edit Trust" and restore the checkboxes to their state in step 7.

There is an Export All Certificates Firefox Addon that will make the exporting process easier (you know, as a backup). Firefox natively won't let you export multiple certificates at once. However, you can't bulk "Edit Trust". You can probably bulk delete/distrust. Honestly though, if things go bad just reinstall Firefox. If that doesn't work, make sure to remove your Firefox user profile folder before reinstalling.

Of course another backup/safety net, is just to have another web browser instead. In that case if Firefox/Convergence fail to load a site, just try the second browser.