1. A computer-implemented method comprising: receiving over time reports containing data describing certificate authority certificates captured from messages exchanged between clients and servers; storing metadata and statistics for certificates contained in the reports; and determining whether a certificate authority has been compromised based on the metadata and statistics.