"Compelled certificate creation attack"

[unixronin]

Security researchers point out that SSL (Secure Sockets Layer) is vulnerable to what they call the compelled certificate creation attack, in which a government agency (say, the NSA) or operative thereof coerces a certificate issuer (such as Verisign) to issue a falsified SSL certificate, which the agency can then use with certificate renegotiation to perform a transparent man-in-the-middle attack against SSL.

Comments

[randwolf.livejournal.com]

Or the Russian Business Network. Hmpf.

[unixronin.livejournal.com]

Indeed. Or, as mentioned in the article, the Chinese top-level certificate issuer, already widely believed to be complicit in Chinese government spying.