This is one of the threats addressed by https://www.certificate-transparency.org/ https://www.certificate-transparency.org/ . If a CA issues a rogue cert and _

This is one of the threats addressed by https://www.certificate-transparency.org/ https://www.certificate-transparency.org/ . If a CA issues a rogue cert and _does_ add it to the CT log, it's discoverable, at least in retrospect. If a CA issues a rogue cert and _doesn't_ add it to the log, some browsers will refuse the connection when presented with that cert. https://www.agwa.name/blog/post/how_will_certificate_transparency_logs_be_audited_in_practice https://www.agwa.name/blog/post/how_will_certificate_transpa... has more details about Chrome's implementation.