Can you rely on that little "green lock" in your browser - Not any more if the following is true.

By the end of 2016, less than 1% of phishing attacks leveraged Web certificates, he continues. By the end of 2017, that number had spiked to 30%. 
"We expect by the end of this year more than half of attacks are [going to be] done using Web certificates," 

Web certificates provide a low-cost means for attackers to convince victims their malicious sites are legitimate, explains Alejandro Correa


https://www.darkreading.com/attacks-breaches/deepphish-simulating-malicious-ai-to-act-like-an-adversary/d/d-id/1333135

A web service running as root user - This happened for HTTPS certificate reseller (Trustico). Guess what - their website goes down. I wonder why?

The vulnerability could be leveraged by miscreants to execute arbitrary commands on the website's host server. A lack of input sanitization allowed carefully crafted commands, submitted as a URL in a web form, to be run on the underlying Linux-powered system, as root no less, meaning anyone who found and exploited the bug could take over the dot-com's web servers.

On Thursday morning, Serbian security researcher Predrag Cujanović tweeted details of a critical flaw in Trustico's website. The site was pulled offline – it just returns a 503 error



https://www.theregister.co.uk/2018/03/01/trustico_website_offline/

Did you know - AV could be tricked to trust a invalid Cert

Simply copying an authenticode signature from a legitimate file to a known malware sample —  results in an invalid signature — can cause antivirus products to stop detecting it.

"This flaw affects 34 antivirus products, to varying degrees, and malware samples taking advantage of this are also common in the wild,"


More Here
https://www.theregister.co.uk/2017/11/01/digital_cert_abuse/

Duqu v2 - Using stolen certs, what's even more scary is the attackers might have more stolen certs

Attackers are getting smarter. A attack like this can be detected but, validating it is hard as they are

1. Using stolen certs
2. Use different certs at different times

From the Article.
The way that the certificates are used by the Duqu attackers is somewhat unusual. Rather than using one certificate for multiple modules or drivers, the group seems to have access to a sizable cache of stolen certificates and use each one just once

Another interesting observation is that besides these Duqu drivers we haven’t uncovered any other malware signed with the same certificates. That rules out the possibility that the certificates have been leaked and are being used by multiple groups. It also seems to indicate the Duqu attackers are the only ones who have access to these certificates, which strengthens the theory they hacked the hardware manufacturers in order to get these certificates,

Duqu attackers are also careful enough not to use same digital certificate twice
For more info:https://threatpost.com/duqu-2-0-attackers-used-stolen-foxconn-certificate-to-sign-driver/113315