This approach is certainly not for everyone, but here is what I have done to mitigate the problem with so many certificate authorities out there. The Comodo breach of March 2011, for example, allowed some bad guys to use a registration authority to generate valid certificates for Google, Yahoo, Skype, etc. There are companies that sell boxes with software that will generate a valid certificates on the fly for every secure web site you visit in order to be able to observe your traffic. With so many CAs, the risk of misuse has increased. These comments mainly apply to Windows.
I think it was during May 2010, I edited the trust level on the root CA certificates in Firefox to only trust about 10 of them. I think I have had to trust maybe two more since then. I started with the list at http://netsekure.org/2010/05/results-after-30-days-of-almost-no-trusted-cas. There are several links on this page that explain a lot about how Windows handles certificates. This is one of the major reasons I use Firefox instead of IE.
To change the trust level of certificates in Firefox, go to Options, select the Encryption tab, and then the View Certificates button. This brings up the Certificate Manger window. The Authorities tab in the Certificate Manage window is where all the CAs are listed. Select each certificate and then select the Edit Trust button at the bottom. This is where you can disable trusting each CA’s certificate. [more]
I also run the Firefox Addon Certificate Patrol which saves every certificate and warns me if a certificate has changed. The primary blogger with the Tor Project, phobos (I don’t know the real name), suggests being your own certificate authority in a manual sort of way and not trusting any external certificate authorities (https://blog.torproject.org/blog/life-without-ca). I decided not to go that far.
If you prefer another browser such as Google Chrome or Internet Explorer, the procedure will be different. Chrome and IE use the Windows certificate store, so you will have to delete the certificates that you do not want to trust. Opera has it’s own store, but operates like Windows, downloading additional root certificates behind your back. You may be able to preload these and remove the trust, but I have not taken the time to look into this. I know nothing about how Safari handles certificates.
As I mentioned at the begining of the article, this approach is not for everyone. However, for technical users with a little patience you can greatly reduce the likelihood you'll fall susceptible to a spoofed SSL certificate.