What happened in the DigiNotar breach (2011) and the Trustwave case (2012), and what do they show about the CA trust model?

DigiNotar was hacked and issued over 500 fraudulent certificates for Google and others; Trustwave sold a sub-CA certificate to a company for TLS interception. Both show that any trusted CA can vouch for any domain.

• DigiNotar (Netherlands, 2011). Attackers broke into the CA and issued more than 500 fraudulent certificates, including a wildcard for *.google.com, plus certificates for Yahoo!, Mozilla, WordPress and others. Because DigiNotar was a trusted root, those certificates were indistinguishable from real ones. They were used to intercept Gmail traffic of hundreds of thousands of users in Iran. Discovery came from Chrome's built-in pinning of Google's certificates. Browsers removed DigiNotar's roots; the company went bankrupt within weeks.
• Trustwave (2012). The CA admitted it had sold a subordinate CA certificate to a private company so that it could inspect its employees' TLS traffic on a firewall: a licence to create valid certificates for any site on the internet. After public pressure it revoked it.

The structural weakness: browsers trust hundreds of root CAs, including some in countries with heavy surveillance, and by default any of them may issue for any domain. One compromised or careless CA undermines everyone.

Responses since then:

• Certificate Transparency: every publicly trusted certificate must be logged publicly, so site owners can spot mis-issued ones.
• CAA DNS records, which name the CAs allowed to issue for a domain.
• Stricter audits and browser root-program penalties.
• Name constraints on sub-CAs.

Go deeper:

• Wikipedia: DigiNotar — the breach, the Iranian interception and the aftermath.
• heise: Trustwave verkaufte Man-in-the-Middle-Zertifikat (2012) — the sub-CA sale (German).
• Wikipedia: Certificate Transparency — the public logs created in response.