Patch to remove CNNIC and other suspect CA in China by default from nss in system-wide - View it on GitHub