How to detect fake trusted personal/root SSL certificates of target domain

Question

Someone can add a fake SSL cert. into trusted certificates collection. How can I detect these fakes? How can I verify a cert is official, is there any list to compare?

I've added a screenshot of a legal & a fake one (created by Fiddler):

ADDITION: To ensure your sensitive SSL communication is secure, you have to use certificates of common trusted authorities. If someone installed Fiddler -or a malicious software installed its own cert.- then I need to cancel any communication attempts and alert in my app at client's pc.

ADDITION 2 I only care about communication between end user's pc & Google Docs. We know Google Docs web site's public certificate is given by "Google Internet Authority". I think I have to compare it & installed certificate for Google Docs on user's pc.

Last word:

I need to simply compare the certificate in use for target site vs the target site's original SSL certificate just before any SSL comunication.

More info: This link

Answer 1

There is no single "official list". You must compare your list to someone else's list.

• Windows has its own list which is used by Internet Explorer.

• Firefox maintains a separate list of its own.

I don't know about Chrome, Safari or Opera.

But the long and short is you need to compare your list to other lists which you know are correct, for example from a colleague's computer.