Abstract: A computer network security method implemented by configuring a web browser to determine whether a root certificate authority appears in a first list of trusted root certificate authorities that is maintained by an operating system of a host computer that hosts the web browser, determine whether the root certificate authority was included in the first list at the time that the operating system was installed on the host computer or was thereafter included in the first list by the operating system, determine whether the root certificate authority appears in a second list of trusted root certificate authorities that is provided to the web browser by an administrator, determine whether a certificate meets predefined invalidation criteria, and cease to communicate with a party that provided the certificate to the web browser responsive to the web browser determining that the certificate meets the predefined invalidation criteria.