Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Martin Rex <[e-mail]>]

Nicolas Williams wrote:
> 
> On Tue, Jun 29, 2010 at 05:23:24PM -0700, Bill Frantz wrote:
> > 
> > I would be interesting to see which trust roots configured in
> > current browsers are in actual use in the wild. Your collection of
> > certificates could help answer this question, and perhaps help
> > remove cruft from browser distributions.
> 
> Excellent idea!

For some of the browsers, the inclusion of CA certificates is not
a courtesy and free service to users, but instead requires an
non-negligible financial effort on the part of the CA.
There even was a rumor that for one CA whose cert was in every
major browser, and which went out of business, the hardware box
holding the private key to that RootCA cert was auctioned because
of the value that is associated with having a trust anchor
pre-configured and pre-trusted with a huge installed base.

-Martin