Modern Firefox has 171 certificate authorities configured for validating TLS certificates. How many CAs do you really see in a day? a week? a month?
General repo to figure out what certificate authorities are used in my normal browsing. The goal is to determine:
- the minimum CAs one can leave active in their browser without the certificate warning popping up daily,
- what CAs one can remove from their browser without much concern,
- how to automate what CAs are used in "normal" browsing and how often they are seen, per time period (day, week month, year),
- maybe get this code into a browser extension
How?
Current State
Using the local nextdns cache-keys data, just dump that out periodically. We then take each domain, clean it up, and grab the cert from the https connection to find the "issuer". Our Julia code automates this process.
Proposed Steps
- Build a browser extension, something similar to IndicateTLS or root-cert-stats?
- Use mitmproxy and have it do automatic lookups of the CA for every cert seen?
- Use privoxy or squid to record every https site and then lookup the CA later?
Browser Specific
In Firefox, use webRequest.CertificateInfo() and grab issuer, O=