I can't seem to find where the default list of trusted CA's are on my fedora (23) build. Every time I thought I got close I found a README warning me that the file I was looking at would get overwritten if the command
update-ca-trust was ran. And this was verified by me when I was making java keystore edits to
/usr/lib/jvm/java-1.8.0-openjdk-126.96.36.199-1.b14.fc23.x86_64/jre/lib/security/cacerts (my deletions were added back in)
The README's did reference me to look:
/etc/pki/ca-trust/source/ however both seem to be deadends, as every crt file I ran an openssl x509 to inspect on didn't list all the root ca's.
An example of one of the default "trusted" root CA's that I would like to remove:
Alias name: chinainternetnetworkinformationcenterevcertificatesroot Creation date: Jul 5, 2016 Entry type: trustedCertEntry Owner: CN=China Internet Network Information Center EV Certificates Root, O=China Internet Network Information Center, C=CN Issuer: CN=China Internet Network Information Center EV Certificates Root, O=China Internet Network Information Center, C=CN Serial number: 489f0001 Valid from: Tue Aug 31 03:11:25 EDT 2010 until: Sat Aug 31 03:11:25 EDT 2030 Certificate fingerprints: MD5: 55:5D:63:00:97:BD:6A:97:F5:67:AB:4B:FB:6E:63:15 SHA1: 4F:99:AA:93:FB:2B:D1:37:26:A1:99:4A:CE:7F:F0:05:F2:93:5D:1E SHA256: 1C:01:C6:F4:DB:B2:FE:FC:22:55:8B:2B:CA:32:56:3F:49:84:4A:CF:C3:2B:7B:E4:B0:FF:59:9F:9E:8C:7A:F7 Signature algorithm name: SHA1withRSA Version: 3