Microsoft quietly pushes 18 new trusted root certificates
The CA system is so broken. Letting a vendor decide who you should trust to issue intermediate certificates that your software will automatically trust to not issue illegitimate certificates doesn't make the system particularly trustworthy, especially seeing as they are still adding new root CAs for entities with unknown agendas (governmental agencies etc).<p>Maybe the system could be changed to one where domains can only be signed by the DNS registrar, or something.<p>It's pretty crazy that any CA can issue a certificate for any domain. And paying for more validation doesn't help you at all, since it won't keep the "bad guys" from getting an illegitimate one from a cheaper/lazier CA.