Last updated: Nov 2, 2025
Root certificates are the foundation of online trust. They allow your device or browser to verify the identity of websites, apps, and servers, ensuring your connection is secure. Whether you’re browsing the web on iPhone or Windows, installing apps on Android, or using Firefox on your desktop, there’s always a list of trusted “root” Certificate Authorities (CAs) silently working in the background.
But what happens when a root certificate is no longer trustworthy—or worse, compromised? Sometimes a certificate authority goes rogue, a company installs an unwanted root certificate without your consent, or you’re simply trying to tighten your privacy and security. In cases like these, knowing how to remove or distrust a root certificate can be crucial.
This guide shows you exactly how to remove or disable root certificates across different platforms including Apple (macOS and iOS), Android, Microsoft Windows, and Mozilla Firefox. We’ll explain when removal makes sense, provide step-by-step walkthroughs for each system, and offer expert tips for both everyday users and IT admins. Before you dive in, remember: removing a root certificate can break websites, apps, or services that rely on it—so proceed with caution and always have a backup plan.
Why and When Should You Remove a Root Certificate?
Before you start deleting or distrusting root certificates, it’s important to understand why they exist and when it’s appropriate to remove them.
A root certificate is part of the public key infrastructure (PKI) used to authenticate servers, websites, and applications. Your operating system or browser ships with a list of trusted Certificate Authorities (CAs) that it believes are secure and legitimate. If one of these CAs issues a certificate for a malicious website or becomes compromised, your device may start trusting harmful connections.
Here are some common reasons you might want to remove or distrust a root certificate:
-
The certificate authority has been compromised or distrusted
(e.g., DigiNotar or MV Certificates incidents) -
You find a root certificate you don’t recognize or didn’t authorize
(Potentially installed by malware, corporate tools, or third-party software) -
Your company policy requires you to manage or restrict trusted CAs
(Often applies to IT administrators and enterprise environments) -
You want to enhance your personal privacy and security
(Some users prefer to remove or block unused or unneeded root CAs)
However, removing or distrusting a root certificate can cause issues:
-
Websites may stop loading properly
-
Email, VPN, or app connections could break
-
System security warnings may increase
So, before removing any certificate, make sure you understand the impact. Always back up your configuration or take note of the certificate details so you can restore it if necessary. The next sections guide you through the removal process on each platform, from macOS to Android to Firefox, with clear steps you can follow safely.
How to Remove Root Certificates on Windows (Microsoft)
Windows manages certificates using a built-in certificate store, which is shared across most browsers (like Chrome and Edge) and system-wide applications. Removing a root certificate here affects everything that relies on the Windows Root Store, so proceed carefully.
Steps to Remove a Root Certificate in Windows
-
Open the Certificate Manager
-
Press
Win + Rto open the Run dialog. -
Type
mmcand press Enter. This opens the Microsoft Management Console.
-
-
Add the Certificates Snap-In
-
In MMC, go to File > Add/Remove Snap-in…
-
Select Certificates from the list and click Add.
-
Choose Computer account (not “My user account”) and click Next, then Finish.
-
-
Navigate to the Trusted Root Certification Authorities
-
In the left pane, expand Certificates (Local Computer).
-
Click into Trusted Root Certification Authorities > Certificates.
This is where trusted root CAs are stored.
-
-
Locate the Certificate You Want to Remove or Disable
-
Scroll through the list or use the Find… action to search by name or thumbprint.
-
Double-click any entry to view details like issuer, expiration, and purpose.
-
-
Remove or Disable the Certificate
-
To remove: Right-click the certificate → Delete.
-
To disable without deleting: Right-click → Properties → in the General tab, check Disable all purposes for this certificate.
This keeps the certificate in the store but prevents it from being used.
-
-
Restart and Test
-
After making changes, restart your browser or computer.
-
Test common websites and services to ensure nothing critical has been broken.
-
Important Notes for Windows Users
-
Removing built-in system root certificates may not always be allowed. You may only be able to mark them as “untrusted” or “disabled.”
-
If you’re in a company network, certificate settings might be managed by Group Policy. Talk to your IT administrator before making changes.
-
Use this method only if you fully trust your judgment or have a clear reason to remove a specific root certificate.
How to Remove Root Certificates on macOS (Apple Desktop)
macOS uses Keychain Access to manage certificates for the entire system. Removing or distrusting a certificate here affects trusted connections across most applications, including Safari, Mail, and even some apps that rely on system-wide SSL/TLS validation.
Steps to Remove or Distrust a Root Certificate on macOS
-
Open Keychain Access
-
Press
Command + Spaceand type Keychain Access, then hit Enter. -
Alternatively, open Finder, go to Applications > Utilities, and click Keychain Access.
-
-
Navigate to the System Roots Keychain
-
In the left sidebar, select System Roots.
-
Make sure Certificates is selected in the Category list at the bottom.
-
-
Locate the Root Certificate You Want to Remove
-
Scroll through the list or use the search bar to find the certificate by name.
-
Double-click the certificate to view details like issuer and validity.
-
-
Distrust the Certificate
-
In the certificate information window, expand the Trust section.
-
Change the When using this certificate dropdown to Never Trust.
-
Close the window. You may be prompted to enter your administrator password to confirm.
-
-
Fully Remove the Certificate (If Possible)
-
Right-click the certificate in the list and click Delete “<Certificate Name>”.
-
Note: Some built-in root certificates cannot be fully removed, only marked as “Never Trust.”
-
-
Restart and Verify
-
Restart your browser and any apps affected by this certificate.
-
Try loading trusted websites to verify everything works as normal.
-
Key Notes for macOS Users
-
Most system-provided root certificates are protected and can only be set to “Never Trust,” not fully deleted.
-
If you’re unsure whether a certificate should be removed, check its fingerprint or consult an IT specialist.
-
Apps like Google Chrome and Mozilla Firefox may use their own root stores, so removing a certificate from macOS won’t affect those apps unless they rely on the macOS trust store.
