How can I remove trusted CAs on Android? From the current fallout around DigiNotar (in short, a Root Certificate Authority that has been hacked, fake HTTPS certificates issued, MITM attacks very likely), there are some parts concerning Android (see yesterday's interim report in PDF):


fraudulent certificates for *.android.com has been generated (which would include market.android.com)
there may be other such fraudulent certificates signed by this CA in the wild (currently nobody knows for sure, one way or the other)
this could happen to another CA in the future (Comodo had a similar problem a few months ago)


So, how do I remove a CA I no longer trust from my Android phone? (I have root and CM6 on my specific phone, if that's relevant)
In Android Lollipop 5.0
Settings &rarr; Security &rarr;  Trusted credentials &rarr;  User tab &rarr;  Select your certificate &rarr;  Scroll down, Click on Remove button &rarr;    Done.