Trust me, I'm a Root CA! Analyzing SSL Root CAs in Modern Browsers and Operating Systems
Analyzing Forged SSL Certificates in the Wild