Remove all root CAs from Google Chromes SSL settings?

After the disaster with diginotar I want to remove all existing root CAs from my Google Chrome installation. Can I delete the pre-installed root CA settings somehow?

The settings dialog doesn't allow me to remove it at the moment:

enter image description here

cringe

Posted 2011-10-08T10:11:50.913

Reputation: 223

2Everyone has updated their root certificate stores to remove DigiNotar. You are over reacting and what you want to do will have the opposite effect. – Moab – 2011-10-08T15:09:08.587

Penny wise, pound foolish. . . – surfasb – 2011-10-08T22:48:16.227

Answers

On Linux, the certificates are kept in a read-only database, and would reappear on upgrading Chromium. However, you can mark them as untrusted, since the trust bits are stored separately as user preferences. Just click Edit... (Bearbeiten...) and disable all three trust bits.

However, keep in mind what @nkvp and others have said – this will make you less secure, since there will be no way for you to verify any certificate even if the CA in question is perfectly secure. Unfortunately, neither Perspectives nor Convergence are available for Chrome yet, so you would be left in doubt 100% of the time.

user1686

Posted 2011-10-08T10:11:50.913

Reputation: 283 655

It is not wise to remove all existing root CAs since it will be very difficult to identify trustworthy sites from that with fake certificates ( all ssl certs will become untrusted so warnings will be generated for all certificates),

Thus man-in-the-middle attacks will be easy since the user will most probably not be able to find if the certificates presented by the site is fake.

nkvp

Posted 2011-10-08T10:11:50.913

Reputation: 73

So there is no way to remove the CAs? – cringe – 2011-10-08T11:36:11.773

1@cringe: There is a way. Stop using HTTPS. Boom, no CAs needed. – surfasb – 2011-10-08T22:47:36.307

Chrome uses the Windows SSL store, so you just need to delete them from Internet Options in windows.

I'd like to reiterate what has been said in the comments. This is a fundamentally stupid thing to do, as you will have no way of verifying any site is legitimate, unless you manually check each certificate. It isn't enough to view them, you need to ensure the public key for the CA is correct.

Paul

Posted 2011-10-08T10:11:50.913

Reputation: 52 173