Digital signatures, certificates and PKI

In the summer of 2011 an intruder got inside DigiNotar, a Dutch certificate authority trusted by every major browser. According to the investigation, on 10 July a certificate for Google was issued from its systems. It was used to intercept the Gmail sessions of roughly 300,000 people, most of them in Iran, whose browsers showed a valid padlock throughout.

The forensic report counted 531 fraudulent certificates for 344 domain names. Browser vendors removed their trust in DigiNotar, and in September the company filed for bankruptcy. The mathematics had worked perfectly; the trust model around it had not.