Hacker News Reader

Comment by guelo | Hacker News Reader

I just went to delete these roots from my Windows system but it's not listed. It was in Firefox's list but not in Window's. Anyone know why?

View on HN

The root certificates trusted by Windows are fetched from Microsoft's servers as needed. You can download all of them using the command:

    certutil -generateSSTFromWU roots.sst

Then if you open up roots.sst (it opens in certmgr.msc) and sort by Friendly Name, you should see the WoSign roots. You can then export these and import them into the Untrusted Certificates store if you wish to block WoSign as a trusted root.

They're cross-signed by startcom.

I'm not familiar with this. Does it mean that if you trust StartCom you have to trust WoSign?

No, you can explicitly install the WoSign certificate into the "Untrusted Certificates" chain.

Given StartCom's bad behavior, you're probably better off marking them untrusted too.

Windows actually trusts 5 WoSign roots by default, regardless of the StartCom cross-signing.

Friendly names: WoSign - WoSign 1999 - WoSign ECC - WoSign G2 - WoSign China

Anybody know how to delete certs from Firefox on OS X?

Settings -> Advanced -> Certificates -> View Certificates -> Authorities

Reply on news.ycombinator.com