google.com's X.509 certificate issuer: http://www.flickr.com/photos/31717414@N06/6543437881/
The certificate authorities installed in my browser: http://www.flickr.com/photos/31717414@N06/6543437849/
I see plenty of Thawte stuff but no Thawte SGC CA and Thawte Consulting (Pty) Ltd. stuff. Shouldn't the name of the issuer of the google.com cert match the name of one of the certificate authorities exactly?
SGC is server gated cryptography which allows older browsers (e.g., 40-bit security) to connect to 128-bit; see for example: http://www.sslshopper.com/article-say-no-to-sgc-ssl-certificates.html
But anyways the certificate for www.google.com was issued by:
CN = Thawte SGC CA
O = Thawte Consulting (Pty) Ltd.
C = ZA
and Thawte SGC CA was issued by
OU = Class 3 Public Primary Certification Authority
O = VeriSign, Inc.
C = US
which your browser probably has as a trusted certificate authority.
Scroll down in the list to Verisign, Inc. You'll see Thawte SGC CA listed under Verisign. The hint to look there is that Verisign appears at the top of the hierarchy in your first screenshot.
