Thanks for your answer. But how to trust our browsers? For example in Firefox there are as CAs: - Xramp security services, but it looks like their web site i

Thanks for your answer. But how to trust our browsers? For example in Firefox there are as CAs: - Xramp security services, but it looks like their web site is not reachable [1] A related website [0] is even not on HTTPS? How this is supposed to be a valid CA? Yet if a certificate is signed by this CA, a browser will signal no warning (except if it tries to reach their OCSP end point). [0] http://xramp.com http://xramp.com [1] www.xrampsecurity.com