revokechinacerts

On the "CAs is controlled by state" side, some privacy enthusiasts in China already removed those CAs from their system long ago. Go give them some hug and support: https://github.com/chengr28/RevokeChinaCerts And of course, in the context of CA, what's truly important is transparency in the audit process and continuous monitoring. Catch them red handed will end their business[0] once and for all. And so far, most of them are rule-abiding. [0] https://blog.mozilla.org/security/2016/10/24/distrusting-new...

Also this: https://github.com/chengr28/RevokeChinaCerts/

Qihoo offers CDN and managed DNS services[1]. The choice is odd on StartSSL's part but may not be necessarily insidious. What more, not using their services does not enhance or harm your security in many meaningful way as long as they remain a trusted CA who can sign any domain they want to. If nation-state espionage is really a concern for you, take a few minutes of your time and purge the list of trust anchors installed on your OS[2]. [1]:https://cdn.cloud.360.cn/ [2]:https://github.com/chengr28/RevokeChinaCerts

If you want remove all China CAs, it may be helpful. https://github.com/chengr28/RevokeChinaCerts