Hacker News Reader

Just delete the cert altogether - there's no reason to leave it on the system at this point (i.e. Google Chrome does not trust it in the latest updates regardless).

http://vimeo.com/28362457

View on HN

The problem is the certificate can be re-added when you do an update (if the update included new root CA's). Thus it's usually safer to just mark the CA as untrusted.

The update would be a new certificate, and the old one would still be marked as untrusted (unless it was deleted by the update). Even if you mark the old one as untrusted the new one would work regardless (i.e. there's 5 Verisign root certs in Lion - 2x class 3s).

I doubt root cert updates are an update to the entire set (at least that's what I would hope) - less chance of breaking something else in the process.

Reply on news.ycombinator.com