After the recent eMudhra CA incident, I wondered why my system trusts over 150 root signing authorities, most of which I don't need?

I decided to scratch my own itch and make a tool to block the long tail of unwanted CA certificates.

distrust is a policy-based tool that aims to simplify the management of the mess of root stores: browsers (NSS, Chrome Root Store), OpenSSL/GnuTLS consumers (curl, wget, Python, Go), Java, and the standalone PEM bundles that apps ship (certifi, conda, botocore).

It ships with an example policy that blocks all CAs except the top 30. I've tested and this seems fine for my normal browsing and usage.

There did not appear to be existing tools to do this, probably because there is so much variance across operating system platforms, distros, and programming languages. distrust is therefore shamelessly vibe-coded to deal with all these edge cases.

https://github.com/hyperreality/distrust