Yes and no.<p>At a basic level, yes, any CA can issue a certificate which can be used to launch a MITM attack. We trust that the CAs don&#x27;t do this. If they&#x27;re caught, the browser industry tends to revoke their CA status -- which is pretty bad for the CA&#x27;s business model.<p>That said, the CAs have been under increased scrutiny lately, and browsers are starting to build additional protections against this kind of thing:<p>- Certificate pinning (HPKP) allows sites to restrict which certificates can be used for a specific host, even if the certificate is signed by a trusted system root. (Caveat: HPKP isn&#x27;t enforced for local roots, installed by an admin. That&#x27;s how Kazakhstan is able to get away with this, because they&#x27;re asking users to install a new root manually.)<p>- Certificate Transparency is supposed to provide an audit log for CAs, so that any maliciously issued certificates can be detected and acted on.<p>That said, these features are new and not universally supported by all browsers. And neither would help in a case like Kazakhstan, where users are being asked to bypass security features and there&#x27;s no system root to revoke.