Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Peter Gutmann <[e-mail]>]

Martin Rex <[e-mail]> writes:

>There even was a rumor that for one CA whose cert was in every major browser,
>and which went out of business, the hardware box holding the private key to
>that RootCA cert was auctioned because of the value that is associated with
>having a trust anchor pre-configured and pre-trusted with a huge installed
>base.

That's not a rumour, that's happened to a number of CAs, and some have been
on-sold more than once (in one case the employees issued themselves sub-CA
certs in lieu of severance pay, in another when the original employees were
dumped there was no-one left who knew how to issue CRLs, so revocations
stopped at that point).  In addition there were root CAs in browsers where no-
one knew any more who controlled the keys.  And there are unknown numbers of
sub-CAs created by trusted roots who... well, you get the picture.  It's a
real house of cards.

Peter.