On thinking about it a little more, I guess when you visit a site with SSL, and that site subsequently sends you its public key, which in turns allows you to send it encrypted data, Firefox will only accept public keys signed (authorised) by those companies in your root certificate list.<p>This means if, unknown to you, CINIC impersonates a domain which uses SSL, and you visit that domain and assume your SSL connection will be safe from prying Chinese officials, you're incorrect. Incorrect because Chinese officials could have created that bogus SSL certificate, and it would be accepted by Firefox because Firefox now accept CINIC as a root authority.<p>Any confirmation, in case I'm spreading inaccuracies, would be appreciated.