Find out which certificate authorities do not come with the system I believe that some of the programs I downloaded in the past have installed some root certificate authorities on my Mac (the OS is Mavericks). After learning more about SSL/TLS, I figure that this is a security risk and I want to fix it. How do I distinguish these CAs from the ones preinstalled with the OS so that I can get rid of them?
You could use the reverse engineering method.

Here is the list of all aps that come with Mac.

So any CA you find in key chain that are not those are the one you are looking for.