Yeah it's just a tool and yeah your workplace or school might need one to "keep the children safe", and yeah they're not responsible for what their customers do with their products. But when they knowingly sell[1] to repressive governments where bad things happen to dissenters, what does that make them? And please spare us the "terrorist" and "criminal" barf, we've heard it in the West.
Any Blue Coat care to comment?
1. https://www.eff.org/deeplinks/2011/10/blue-coat-acknowledges...
They would have to give their private key to their clients to achieve a MITM attack, right?
Others have suggested they could provide a cloud-type service to achieve the same result.
[0]: https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-tec...
Thats literally the one thing you aren't allowed to do as a CA.
Because they (and the companies they own, like Verisign), are the root of about 30-40% of all active, web-visible ssl certs at the moment.
No browser maker, even Google is going to break that much of the web over one shady intermediate cert. The consequences for users are too high and too many people are willing to excuse it because it's "only" a pathlen=0 and it would be noticed if used en masse so it's "only" useful for targeted attacks by state-actor clients.
Well, "fortunately", Blue Coat Systems, leading manufacturer of intercept devices for authoritarian regimes, now has an intermediate cert courtesy of Symantec CA, so they're fully capable of issuing and installing MITM certs for use on their clients' devices.