1. A computer-implemented method comprising: receiving over time reports containing data describing certificate authority certificates captured from messages exchanged between clients and servers; storing metadata and statistics for certificates contained in the reports, wherein the metadata includes, for each certificate, an issuer of the certificate and an indication of whether or not the certificate has been verified by a central authority, and wherein the statistics include, for each certificate, a date first reported, number of reports received, and time and geographical distribution of reports received; determining whether a certificate authority has been compromised based on the metadata and the statistics; and if it is determined that the certificate authority has been compromised, sending to one or more network devices an indication that the certificate authority has been compromised.