CAStripper Root Trust Slimmer

Help developers prune unnecessary and risky root CAs

Problem

Systems trust 150+ root CAs by default, most of which aren't needed. The recent eMudhra CA incident showed the risk: once a trusted CA goes rogue, your security assumptions collapse. Users and developers have to manually sift through huge root lists without knowing which to disable safely.

Solution

A cross-platform scanner that flags risky CAs based on usage and origin, then generates policy scripts to disable them (like Go's distrust). Includes a safe rollback and whitelist of critical CAs, allowing users to keep only what's necessary.

Users

Security-conscious developers, DevOps engineers, privacy-focused power users

MVP

Scan root stores on OS and browsers; rank CAs by risk; generate reversible disable/enable scripts; include rollback and compatibility checks; provide OS/browser-specific guides

Revenue

Open core + team policy management subscription (~$8/mo), or paid enterprise audit reports

Why now

Frequent CA incidents raise awareness of root trust; existing tools are platform-specific, and an indie can quickly build a cross-platform, user-friendly version