> The police station in Stockholm can read visitors HTTPS traffic over their WiFi in clear text and they show it to you when you are there. They simply substitu

> The police station in Stockholm can read visitors HTTPS traffic over their WiFi in clear text and they show it to you when you are there. They simply substitute their root cert and your browser behaves like normal only they can decrypt your HTTPS traffic. If you have actual proof of this (e.g. a copy of one of the rogue certificates issued by this CA) you can get them banned from all major browsers by emailing said proof to dev-security-policy@mozilla.org My guess though is that you're simply incorrect; the root cert they use is most likely not trusted by modern browsers. Stockholm police can't intercept visitors' HTTPS traffic without their browser displaying an error page, or without those visitors manually marking the Stockholm police's CA as trusted.