# Updating pki certs to remove unwanted mozilla certs

**URL:** <https://forums.rockylinux.org/t/updating-pki-certs-to-remove-unwanted-mozilla-certs/10232>\
**Category:** Rocky Linux Help & Support\
**Created:** [June 8, 2023, 2:30pm UTC](https://forums.rockylinux.org/t/updating-pki-certs-to-remove-unwanted-mozilla-certs/10232 "2023-06-08T14:30:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![smart](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/smart/32/3145_2.png) [@smart](https://forums.rockylinux.org/u/smart)\
**Post date:** [June 8, 2023, 2:30pm UTC](https://forums.rockylinux.org/t/updating-pki-certs-to-remove-unwanted-mozilla-certs/10232/1 "2023-06-08T14:30:58Z")

</div>

Sometimes it is a good security practice to remove unneeded ca certiticates from the base system and applications such as firefox and thunderbird.

For starters you can verify for presence of FooVadis certs this way on Rocky Linux 9.2 :  
`$ trust list --filter=ca-anchors | grep FooVadis -i -A 2 -B 3`

Then update source ca-bundle file with text editor as root:  
`$ sudo nvim /usr/share/pki/ca-trust-source/ca-bundle.trust.p11-kit`

Dont forget running update-ca-trust at this point…  
`$ sudo update-ca-trust`

To verify your changes, just run trust list again :  
`$ trust list --filter=ca-anchors | grep ...`

Cheers,  
smart

---

<div class="post-metadata">

**Author:** ![mdcTUX](https://avatars.discourse-cdn.com/v4/letter/m/ecd19e/32.png) [@mdcTUX](https://forums.rockylinux.org/u/mdcTUX)\
**Post date:** [June 9, 2023, 4:46am UTC](https://forums.rockylinux.org/t/updating-pki-certs-to-remove-unwanted-mozilla-certs/10232/2 "2023-06-09T04:46:07Z")

</div>

This is an bad idea, because there exist an official way to do this.  
Simple copy the ca block to /etc/pki/ca-trust/source/blacklist (as pem file)  
Than call update-ca-trust.  
This will be update safe, and will work with java, gnutls, nss , and openssl based apps.

---

<div class="post-metadata">

**Author:** ![smart](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/smart/32/3145_2.png) [@smart](https://forums.rockylinux.org/u/smart)\
**Post date:** [June 9, 2023, 8:35am UTC](https://forums.rockylinux.org/t/updating-pki-certs-to-remove-unwanted-mozilla-certs/10232/3 "2023-06-09T08:35:22Z")

</div>

Hi mate,

i followed the documentation in update-ca-trust man page… Note that  
the ca block on Rocky Linux 9.2 is located in /etc/pki/ca-trust/extracted and must not be edited manually because it is being autogenerated !

---

<div class="post-metadata">

**Author:** ![label](https://avatars.discourse-cdn.com/v4/letter/l/c5a1d2/32.png) [@label](https://forums.rockylinux.org/u/label)\
**Post date:** [August 24, 2023, 4:53am UTC](https://forums.rockylinux.org/t/updating-pki-certs-to-remove-unwanted-mozilla-certs/10232/4 "2023-08-24T04:53:34Z")

</div>