There's one thing that I've never quite understood about SSL (which perhaps means I don't understand SSL at all): how is SSL secure from rogue Certificate Authorities?
This is probably best elaborated as an example:
Suppose company B buys a certificate C from certificate authority A.
Now, normally I would go to the website, B's servers shows me certificate C, I see it's signed by A, I trust A's root certificate, everything is dandy, and off I go to throw furious avians at malicious boars.
But suppose, for whatever reason, someone M persuades/tricks a different certificate authority N to issue them a certificate Q that looks just like certificate C but isn't.
Now if M does something to man-in-the-middle me, my understanding is that M's server shows me Q, I see Q signed by N, I trust N's root certificate, everything is dandy...except it's not because M can see all my plaintext, and is free to do with it as he wishes, including the other half of the MITM if he wants, passing the information on to B, etc.
(I know this is a classic MITM with an SSL twist, but I just wanted to be really clear with my logic just in case I missed something along the way that's relevant.)
I'm guessing that there's some other protection to mitigate against this, I presume? I hope? ...Please?