I think they meant unrestricted signing certificate. A few CA's have been caught providing this to external entities and have been pulled from trust stores. T

I think they meant unrestricted signing certificate. A few CA's have been caught providing this to external entities and have been pulled from trust stores. The cynical side of me assumes the behavior just moves to another shell company. For those curious how to mitigate or at least identify when this is occurring, you could trust transparency reports, or if you don't trust those, then log certificate fingerprints of the sites you visit. for domain in $(cat ./mydomains.txt); do echo -en "${domain} "; openssl s_client -servername "${domain}" -connect "${domain}":443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin; done|sort -k2 -t"=" | awk {'print $NF "\t" $1'} | column -t Fingerprint=4C:B1:F9:42:9A:58:CB:E2:7F:92:27:A9:41:5B:15:8B:01:3B:D1:64 ycombinator.com Fingerprint=98:70:50:FF:B9:05:CA:D3:A7:9A:85:96:C2:12:0D:B9:7C:03:A1:65 news.ycombinator.com It's probably also worth logging the creation/expiration dates too, given that certs expire so much quicker these days. If you wanted to make this information even more useful, have people all around the world run this and feed it into a distributed database and log the ISP the test was run from so that you can see if a particular ISP has been compromised. That is how some folks I know in Africa found out their ISP was using BlueCoat proxies and that the certs were being installed as part of their ISP's required package downloads.