I thought the same.  I think at this point we&#x27;ve graduated from &quot;there&#x27;s already a metasploit &#x2F; other open source code for it&quot; to &quot;it&#x27;s probably possible, if you are fairly determined but not necessarily the NSA&quot;.  There&#x27;s probably a few CAs with lax security procedures, just given how many there are... but hacking one is a much bigger endeavor than SSL stripping.