From helpnetsecurity.com
There is no dearth of compromised, fake and forged SSL/TLS certificates for sale on dark web markets, researchers have found.
TLS certificates are sold individually and packaged with a wide range of crimeware. Together these services deliver machine-identities-as-a-service to cybercriminals who wish to spoof websites, eavesdrop on encrypted traffic, perform man-in-the-middle attacks and steal sensitive data.