TL;DR: The certificate is associated with a private key which can decrypt the traffic for a session established using the cert. The issue is that, given a bog

TL;DR: The certificate is associated with a private key which can decrypt the traffic for a session established using the cert. The issue is that, given a bogus certificate from a trusted authority, someone can impersonate any site they want, then proxy the traffic to the real site and spy on your session. Longer explanation: If an organization is able to obtain a certificate that the browser trusts, which matches the domain name you are visiting, then they can easily terminate the TLS at the organization's server, then make a new request to the site, where the encrypted session is between the site and the organization's proxy server. They get an effective man-in-the-middle attack and your browser pretends like everything is secure because there is a trusted certificate matching the domain name you visited. The browser doesn't throw up any red flags because it doesn't differentiate between certificates, only certificate authorities. So if a 3rd party can acquire an arbitrary certificate for some domain, and the 3rd party has the private key associated with that cert, and the same 3rd party can intercept the traffic between you and the domain in question, then they can get your traffic in the clear and there are no obvious signs that they did it. Given the current state of TLS and the way browsers deal with certs, the only way for a user to discover that something is amiss is to investigate the details of the cert. Then they might notice that it was issued by a suspicious certificate authority. Unfortunately, the proposed EU law is attempting to prohibit browser vendors from withholding trust (or otherwise scrutinizing) the state-controlled (or state-influenced) certificate authorities, with the intention of preventing browsers from interfering with government's ability to issue illegitimate/insecure (but you must trust them, or else!) certificates.