I have been carrying out some work on SSL certificates and found that there are some places that charge you for an SSL certificate, but, how do they obtain the rights to do so? And, how, are they allowed to be on a list of "trusted" sites that the browser can identify as genuine?
The big browser companies (Google, Mozilla, Microsoft, Apple and Opera, mainly) include whatever root certificates from certification authorities they want to -- there are no government regulations or laws governing it. However there is a voluntary body called the CA/Browser Forum that lays down standards, and since all of the browser companies listed above are members then in practice a certification authority has to meet those standards to get their certificate included.
In order for a certificate to be accepted there must be a chain of trust from a root certificate in the clients trust store.
Typically the root certificate is not used to sign end entity certificates directly. Instead an "intermediate certificate" is created. The advantage of this is that intermediate certificates can be more easilly revoked if compromised but a compromised intermediate certificate is still a very serious security issue as revocation is a fragile process.
To get their root certificate included in the trust store of major browers CAs have to commit to following certain procedures and to being audited. Unfortunately audits are of limited utility because it's virtually impossible to prove that copies of the private key to the root or intermediate certificates don't exist outside of the audited infrastructure.
CAs with their root certificates in the browser can also issue intermediate certificates to other entities making those entities essentially CAs. The root certificate holder is supposed to take responsibility for the actions of their subordinates but again it's virtually impossible to prove that the keys to the intermediate certs are well controlled.
Recently browser vendors have started taking a greater interest in the activities of CAs and in particular they have started actively looking for misissued certificates in use on the internet. They have also introduced a system called "certificate transparency" which if enforced will require CAs to publiclly declare certificates before they are accepted as valid.
Some sites that sell certficates are run by CAs that hold root certificates. Some are run by organisations that hold intermediate certs but not root certs. Many are just resellers passing certificate requests to organisations in the first two categories.
In order to be included in the "Certificate Store" containing the Root CA references of major web browsers or operating systems vendors (Apple, Microsoft, Mozilla, Linux), you have to meet the industry standards defined by the CABBrowser Forum.
It is also required that your CA infrastructure complies with other aspects such as processes (how to obtain a certificate, where are the private keys stored, how do you certify the identify of the requestors, etc.). In order to prove your compliance your CA will be audited. Traditionally it's done by one of the Big Four audit firms. This expansive procedure is not a one-off process; you have to renew your certification regularly.
For example, Mozilla has defined the following procedure to be included in their web browsers.