How to untrust a ca certificate?
-
Hi,
I try to untrust a ca certificate but vivaldi is still using and accepting https access to sites that using certifcates based on that ca certificate.
To be on the secure side in testing stage I have started to untrust all certificates via vivaldi://settings/certificates . And all ca certificates are shown as "NICHT VERTRAUENSWÜRDIG" ("NOT TRUSTED")
If I check on the console with "certutil -d ~/.pki/nssdb/ -L"
than I got also all certificates as untrusted, e.g. :ISRG Root X2 ,, ISRG Root X1 ,,I also disabled all certifcates on os level via dpkg-reconfigure ca-certificates (/etc/ssl/cert is empty)
In my testscenario all https site should now not be accessable anymore but I am still able to load https pages.
Where are the ca certificates stored that vivaldi is using?
What is the valid way to untrust a specific ca certificate? -
@denkmal On my Debian are these under /etc/ssl/certs/ and /usr/share/ca-certificates/mozilla/
If you do not need them, remove them.//EDIT: Oh, looks like the certificates are builtin Chromium and can not be disabled
https://blog.chromium.org/2022/09/announcing-launch-of-chrome-root-program.html
https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/root_store.md
https://security.googleblog.com/2023/05/how-chrome-root-program-keeps-users-safe.html -
Thanks for your answer. This explains a lot.
