From this blog.Intermediate CAs are certificates signed by a root CA that can sign arbitrary certificates for any websites.They are just as powerful as root CAs, but there's no full list of the ones your system trusts, because root CAs can make new ones at will, and your system will trust them at first sight. There are THOUSANDS logged in CT.This month an interesting one popped up, generated apparently in September 2015: Blue Coat Public Services Intermediate CA, signed by Symantec. (No certificates signed by this CA have reached the CT logs or Censys so far.)I thought it would be a good occasion to write up how to explicitly untrust an intermediate CA that would otherwise be trusted in OS X. It won't stop the root CA from handing a new intermediate to the same organization, but better than nothing.When I tried the steps in the blog in Ubuntu, I download this certificate https://crt.sh/?id=19538258. When I open the .crt it imports into the Gnome Keyring, but then I couldn't find a way to untrust the certificate after importing it.
Untrusting an intermediate CA in Linux?
linux;openssl;ssl;certificates;nss
Just to make things difficult, Linux has more than one library for working with certificates.If you're using Mozilla's NSS, you can Actively Distrust (their terminology) a certificate using certutil's -t trustargs option:$ certutil -d <path to directory containing database> -M -t p -n Blue Coat Public Services Intermediate CAFor Firefox, <path to directory containing database> is usually ~/.mozilla/firefox/<???>.profile where <???> are some random looking characters.  (certutil is eg. in ubuntu's libnss3-tools package)The breakdown is as follows:-M to modify the database-t p to set the trust to Prohibited-n to carry out the operation on the named certificateEven within NSS, not all applications share the same database; so you may have to repeat this process.  For example, to do the same for Chrome, change the -d <path> to -d sql:.pki/nssdb/.$ certutil -d sql:.pki/nssdb/ -M -t p -n Blue Coat Public Services Intermediate CAHowever, not all applications use NSS, so this isn't a complete solution.  For example, I don't believe it's possible to do this with the OpenSSL library.As a consequence, any application that uses OpenSSL to provide it's certificate chain building (TLS, IPSec etc) would trust a chain with a Blue Coat certificate and there is nothing that you can do about it short of removing the Root CA that signed it from your trust anchor store (which would be silly considering it's a Symantec Root CA as you'd end up distrusting half the Internet), whereas applications that rely on NSS can be configured more granular to distrust any chain that has the Blue Coat certificate within it. For example, I believe OpenVPN uses OpenSSL as it's library for certificates, therefore big brother could be listening to your OpenVPN traffic without your knowledge if you are connecting to a commercial VPN provider which uses OpenVPN.  If you are really concerned about that then check who your commercial VPN provider's Root CA is - if it's Symantec/Verisign then maybe it's time to ditch them for someone else?Note that SSH doesn't use X509 certificates therefore you can connect and tunnel using SSH without worrying about Blue Coat MITM attacks.