> 2. They don't care about the Web, and are only part of the Web PKI as a result of some historical happenstance they'd gladly part with at first opportunity. I

> 2. They don't care about the Web, and are only part of the Web PKI as a result of some historical happenstance they'd gladly part with at first opportunity. In this case the fact their certificates don't work in Chrome makes no difference to them, the certificates aren't for Chrome or any web browser, some expensive old industrial device needs a certificate and the ones they're using work. Given the choice between buying a brand new $4M industrial device or retro-fitting logging for the six certificates they issue each year, they'd be very torn and likely find a third way, but for now they don't have to. When the device is beyond economic repair their new one won't be part of the Web PKI because in hindsight that was a mistake. Which CA fits this one? - Mozilla and Apple now requires every CA in its roots to be "alive" (aka still operating) - Microsoft is now actively restricting its public roots in such a way that technically unconstrained certificates that are not actively used for web is coded in Schannel to be denied. - Also, you need to do external audits or else (sans the Oracle Root CA), you will be ejected in all roots. Even the Chinese 360 CA root programme requires active audits. So 2 is only applicable in a very restricted subset that I can safely say that those formerly-public Web CAs are now operating completely privately. That requires a very weird configuration: Windows PC with an application that uses both OpenSSL (or derivative) and the Microsoft root (most OpenSSL installations uses the Mozilla root instead).