I'd like to know until what point and under what circumstances it is fine to rely on HTTPS for client-server communications. In the previous years, there has been some news about hacks of Certificates Authorities (like diginotar), I know there also are some flaws in the way HTTPS work, for example ISP DNS resolvers might not be trustworthy in some region, and send fake HTTPS certificates to the clients...
Let's say i'm running server hosting a website that will handle million dollars of money transactions, it will probably be subject to hacks. The server is ultra-secured (no DDOS, ssh intrusion or code injection possible), my concerns here are about the communication between my server and the clients that might live anywhere in the world.
- Is the choice of the CA to register my domain an important one?
- Are there some CAs that are considered as more safe or less safe?
- Are there some CAs that are blacklisted or forbidden access in some regions of the world? (This would make my clients from those regions unable to access my platform through HTTPS.)
- Is it possible for ISPs to monitor the requests made from client for certificates, and sometime issue fake certificates?