OS Certificate Root Authority scanner (SuperFish/eDellRoot detector)

While Mozilla Foundation does a good job of curating it's own Certificate Root database, this seems to only benefit the TLS sessions that take place directly in Mozilla Foundation products.

Even if an user attempts to only use Firefox as their browser and Thunderbird as their email client, there is still several common applications which will use the OS native TLS stack and CA root database.

We have learned over time that both OS vendors and OEMs are not always as careful when curating their own CA databases.  Over time we have seen Apple's greatly delayed response to remove DigiNotar, Microsoft's 45 bogus certificates resulting in KB2982792, Lenovo's SuperFish certificate and now Dell's eDellRoot.

Part of the problem is these CA Root databases exceed over a hundred entries, it has become difficult for people that are even aware of this general type of issue to keep track of all the entries.

I would like an application that is as self-contained as possible (outside of the UI and network stack, the OS provided functions should be minimal).  It should pull down a Mozilla foundation CA Root database which has been signed by the Mozilla Foundation.  After verifying the signature with an embedded public key, it should provide a comparison between the OS CA Root store and the Mozilla Foundation database.  

On first run, it should then list CA Root entries trusted by the OS that aren't part of the Mozilla Foundation CA Root database.  It should also provide checkboxes to allow the user to select to blacklist CA Root entries.

On additional runs, it should also provide information on blacklisted CA Root entries which have been re-added, new CA Root entries that aren't in the latest Mozilla Foundation CA Root database and also the option to restore CA Root entries that the user previously blacklisted.

While I recognize such a tool would produce false positives for company intranet certificates, the target audience for such CA Root auditor should be able to take these false positives into account (also, whitelisting an OS CA Root entry should be the default).  At the same time, when the utility is used correctly, it should empower users to catch questionable CA Root entries faster and encourage companies to be more transparent about the CA Root entries they are adding.

I believe the current environment of CA Root database abuses has become problematic enough that Mozilla Foundation's Manifesto #4 requires action that goes beyond it's own current products.  I think providing a CA Root audit utility for advance users to monitor the OS CA Root database will go a long way towards helping achieve that goal.