> As the holder of the root certificate used to sign the TLS certificates Trustico was reselling, Symantec was ultimately responsible for ensuring this requirem

> As the holder of the root certificate used to sign the TLS certificates Trustico was reselling, Symantec was ultimately responsible for ensuring this requirement was being followed, although in fairness, there was probably no way for Symantec to detect a violation. This is in some sense the scariest part in the whole mess. Root authorities might have responsibility, but the basic logic of cert resellers makes an error like this easy and undetectable.