How is SSL secure from rogue Certificate Authorities? There's one thing that I've never quite understood about SSL (which perhaps means I don't understand SSL at all): how is SSL secure from rogue Certificate Authorities?

This is probably best elaborated as an example:

Suppose company B buys a certificate C from certificate authority A.

Now, normally I would go to the website, B's servers shows me certificate C, I see it's signed by A, I trust A's root certificate, everything is dandy, and off I go to throw furious avians at malicious boars.

But suppose, for whatever reason, someone M persuades/tricks a different certificate authority N to issue them a certificate Q that looks just like certificate C but isn't.

Now if M does something to man-in-the-middle me, my understanding is that M's server shows me Q, I see Q signed by N, I trust N's root certificate, everything is dandy...except it's not because M can see all my plaintext, and is free to do with it as he wishes, including the other half of the MITM if he wants, passing the information on to B, etc.

(I know this is a classic MITM with an SSL twist, but I just wanted to be really clear with my logic just in case I missed something along the way that's relevant.)

I'm guessing that there's some other protection to mitigate against this, I presume? I hope? ...Please?
SSL offers protection against Man-in-the-Middle only if the client can make sure that what it believes to be the server's public key is, indeed, the true server's public key. X.509 certificates aim at providing this information, but this is relative that no rogue CA was involved. A "rogue CA" is here one of:


An evil or gullible root CA ("subverted" CA might be a more neutral term).
An evil or gullible intermediate CA, whose own certificate was issued by another CA (going up to a trusted root).


In fact, rogue CA are out of scope of X.509. It is a strange assertion, but its meaning is that X.509 works on damage containment:


If a mishap occurs, revocation is used to limit damage in time.
Though nothing technically prevents a rogue CA from issuing a fake certificate, it leaves traces; namely, the fake certificate points at the rogue CA for being, indeed, rogue. Fear of retaliation is supposed to keep CA honest and robust.


Even though a basic OS or Web browser tends to trust a hundred root CA or so by default, and that this trust is limited by the weakest of all of them, it so happens that "mishaps" involving a subverted CA are rare, about once a year or so. This means that the system kind of works in practice. Your understanding of the problem is correct, but experience shows that the mitigations which are in place (retaliation from legal/police forces, and revocation and OS/browser patches) make the attack "not worth it" for the attacker (it won't work for long, and it is risky), which explains why such attacks remain infrequent. I daresay that X.509 is not the weakest link in SSL-powered Web site (and SSL is not the weakest link either; the Web site is the usual problem).