As far as I can tell, a CA is in a position to unilaterally revoke a certificate via the standard mechanisms (CRL, OCSP).
In an increasingly TLS world, what current technology stops a CA shutting down a service they don't like?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Peer pressure, effectively.
There is a multi-layer structure of trust - the CAs trust the browser makers to include their root certificates, and not remove them without reason. The browser manufacturers trust the CAs to only sign certificates for legitimate requests, and implicitly agree to believe this, with the threat of removing the root certificates of CAs that don't actually do this. Website owners trust the CAs to work to keep their root certificates in all popular browser bundles (since manually adding certificates is a massive hurdle to user experience), and the browser manufacturers to keep root certificates in their bundles, unless there is some good reason not to (e.g. the CA asked for them to be removed).
Therefore, if a CA unilaterally revoked a certificate, the browser manufacturers could demand a reason, and, if they found that the reason was insufficient, remove the root certs belonging to that CA. They're unlikely to do so, unless it's a pattern (for example, revoking certificates belonging to sites in favour of a given political party).
By definition, the CA is managing the revocation. In fact, it is a conceptually better way to express thing as: the CA reissues all certificates on a daily basis. The CRL is a kind of data compression: from the point of view of the verifier (say, the Web browser that validates the SSL server's certificate), the certificate is valid as long as the CA says it is OK. To make things lighter, instead of the CA signing a new certificate for each customer every day, the CA signs long-lived certificates and includes only revoked certificates in the CRL. This is an optimization that works under the assumption that most certificates won't be revoked.
Since keeping the certificate afloat is the CA daily job, there is no technology that may prevent the CA from ceasing to do so. What "forces" CA not to revoke certificates on a whim is contract law (you paid the CA for the service, so it is bound by law to maintain that service) and market pressure (if the CA revokes certificates without justification, customers will simply move their business to a competitor).