Hacker News Reader

Comment by yonixw | Hacker News Reader

Distrust Amazon Root CA 1? This is the root CA for a lot of AWS API gateways. Waaaaay Overkill.

Those selected in the screenshot are included in the Mozilla list, thus to be trusted. They instruct to distrust the inversion. Here's quote from the instruction:

    2. Right-click the selection and click Invert selection
    3. Right-click the selection and click Distrust

Firefox doesn't trust the root CA for a lot of AWS API gateways?

The fact that some root stores/browsers don't trust some CAs is actually quite common. There will be some cross-sign from another CA that is trusted in Firefox in this case.

Stuff like this is quite common; we published a paper on this recently if you are interested in details: https://arxiv.org/abs/2009.08772

https://medium.com/@sleevi_/path-building-vs-path-verifying-... also has some utilities to visualize this using JS to explore these relationships, and understand the code tradeoffs.

Reply on news.ycombinator.com