Our company uses a web server with a couple of web sites on it (private and public, over HTTP and HTTPS, some low risk and some high risk including online payments or other sensitive data for example).
In our last project, we communicated with a partner company through web services. They wanted to use their own certificates, issued by themselves, to secure the connection. So we had to install their root certificate "PrivateCompany Root CA" on our web server.
Just how bad is this exactly? In what scenarios our security can be tampered with?