Someone just posted on pastebin (http://pastebin.com/JrVMkXM9) a few PDF with apparently forged certificates that chain to Adobe CA.
While I very much doubt (as the paste could imply) that Adobe is doing mean things, it is still quite troubling to see a certificate issued to "*.google.com" that appears to correctly chain to Adobe Root CA.
All signatures in the documents (some contrats written in French, it seems) are correctly validated by Reader and Acrobat, although they clearly appear bogus. One other certificate is issued to "Adobe Inc.", with a junk email address. The others are for "Obama" and "Jobs".
What is going on? Is there an issue in the signature validation mecanism?
Has a CA been compromised?
Can I still trust Reader and Acrobat when they tell me a signature is valid ?
Regards,
HT