Certificate Authorities normally run as software on a box somewhere. Sometimes they keep this box offline, but they need to keep a sub-CA online somewhere, or

Certificate Authorities normally run as software on a box somewhere. Sometimes they keep this box offline, but they need to keep a sub-CA online somewhere, or they wouldn't be able to issue certificates. So, a CA private key and public certificate can be compromised in much the same way a single server certificate. With a CA private key and public certificate, one can easily emit a bogus certificate for *.google.com or any other domain name. If this CA public certificate is trusted by the browser, a user would hardly notice.