From the current fallout around DigiNotar (in short, a Root Certificate Authority that has been hacked, fake HTTPS certificates issued, MITM attacks very likely), there are some parts concerning Android (see yesterday's interim report in PDF):
- fraudulent certificates for *.android.com has been generated (which would include market.android.com)
- there may be other such fraudulent certificates signed by this CA in the wild (currently nobody knows for sure, one way or the other)
- this could happen to another CA in the future (Comodo had a similar problem a few months ago)
So, how do I remove a CA I no longer trust from my Android phone? (I have root and CM6 on my specific phone, if that's relevant)