Hacker News Reader

Comment by midislack | Hacker News Reader

There are so many dodgy root certs these days. First thing I do is delete a BUNCH of them when installing or upgrading a browser.

Is there a decent guide somewhere of what is safe to remove? I feel like I should prune root CAs, but also like I would need to know a lot more.

Maybe delete everything except Lets Encrypt and then re-enable ones for the sites you regularly visit that are now broken.

You can get pretty good coverage (>90%) by just having the top 6 CAs (IdenTrust, DigiCert, Sectigo, GoDaddy, Let's Encrypt, GlobalSign): https://w3techs.com/technologies/overview/ssl_certificate

That's an excellent idea.

How to remove on Debian and family:

    sudo dpkg-reconfigure ca-certificates