[SSL Observatory] the CA sub-CA smoking gun

[Jacob Appelbaum]

Hi,

I noticed this statement today by Trustwave on their website:

1/26/2012 - Trustwave CA Policy Update

It has been common practice for Trusted CAs to issue subordinate roots
for enterprises for the purpose of transparently managing encrypted
traffic. In the past, Trustwave, like many of our peers in the industry,
has enabled organizations to perform this activity. Due to events of the
past year, Trustwave has decided to revoke all subordinate roots issued
for this purpose.

XRamp Security Services, Inc. (successor to SecureTrust Corporation),
has been acquired by and is a wholly-owned subsidiary of Trustwave
Holdings, Inc. ("Trustwave")

It's posted here:
https://ssl.trustwave.com/CA/

I wonder who their peers are in the industry? Will they come out and
tell us as well?

Their website says they'd love to hear from anyone with questions:
"Please do not hesitate to call Trustwave 1-866-775-2378 with any
questions."

If anyone calls and asks, please do let the list know what Trustwave has
to say on the issue...

All the best,
Jake