certspotter VS rap

> 1. Is this proactively monitored for? And how? And by whom?

Yes, security researchers and domain owners use Certificate Transparency Monitors to search for certificates. e.g.:

https://crt.sh/ - allows you to search for certificates for a domain

https://github.com/SSLMate/certspotter/ - open source tool which notifies you when a certificate is issued for one of your domains

https://sslmate.com/certspotter/ - commercial service that does the same, operated by my company

> 2. If a major state-level CA was discovered to have issued a mitm cert, would browser vendors really take the commercial hit of removing or distrusting their root cert?

In 2017, Chrome and Firefox distrusted Symantec, which was at the time the world's largest certificate authority: https://security.googleblog.com/2017/09/chromes-plan-to-dist...

Symantec hadn't even issued MitM certs - they were just grossly incompetent. Distrusting them was very painful, but necessary to upload the integrity of the CA system, and demonstrated conclusively that there is no such thing as a too-big-to-fail CA.

Indeed, a CT monitor which sends alerts about legitimate certificates is pretty much useless due to noise. My service, Cert Spotter, provides an API endpoint[1] which you can upload your CSRs to, so you don't get alerted about certificates using the same key as the CSR. The open source version of Cert Spotter can invoke a script[2] when a certificate is discovered, and the script can cross reference against a list of legitimate certs.

[1] https://sslmate.com/help/reference/certspotter_authorization...

[2] https://github.com/SSLMate/certspotter/blob/master/man/certs...

Have you checked out RIPE atlas?

Volunteers run probes and earn credits. Credits can be shared and spent to run measurements of their custom design. All measurement results are public info (I’m pretty sure, it’s been a while since I did stuff with RIPE atlas).

So all that nonsense about credits and volunteering may not matter to you if the results are useful.

https://atlas.ripe.net/

https://en.m.wikipedia.org/wiki/RIPE_Atlas

Is it just me, or would a recurring RIPE Atlas measurement be a great way to detect fuckery like this?

https://atlas.ripe.net/

mine's deployed as a RIPE Atlas probe! https://atlas.ripe.net/

it earns credits by being online, and allows me to in turn measure other probes around the world to check for traceroutes and other networking stats.

Then if you want to dig deeper you can make a RIPE atlas account https://atlas.ripe.net which will allow you to ping and traceroute a target from other machines from your country or ISP.

Would you be willing to install a RIPE Atlas probe in your house to continuously test latency and other stuff (https://atlas.ripe.net/)? This is a 3rd party - totally unrelated to Comcast. We're a sponsor so get a bunch of probes to send out each year. I've deployed 100s in the US - be more than happy to UPS you one if you like (if so PM me).

also the ripe atlas community https://atlas.ripe.net/ . everyone: if you can, host a probe!