Is there a source that monitors popular root stores for CAs controlled by government agencies?
There are several "root stores" that maintain a list of trusted root CAs. These root stores are imported and used by thousands (millions?) of apps to determine which https certificates are trusted. Their contents has a huge impact on the entire X.509 security infrastructure.
A few examples of such trusted root stores include those maintained by the following organizations:
Most of the CAs in these root stores are private corporations that issue certificates for customers, such as Verisign. Depending on the policy of the root store maintainer (see links above), the list may also contain CAs controlled by nonprofit organizations or government agencies.
In the past, the maintainers of these root stores have removed CA's root certs for corporations who had lost control of their root certificates. [8][9] Similarly, there have been several historic controversies with CAs operated by government agencies. [10][11] And also with private entities that have been accused of being malicious actors (cyber-mercenaries) on behalf of governments. [12]
I'm especially interested in knowing which Nation States that have been known to initiate cyber attacks (including the use of passive and active MITM attacks) have CAs in these root stores.
Is there a publicly-available list of government agencies that possess root CAs that are listed in popular, trusted root stores?
