Comment by cowlevel

There's also the jabber.ru attack, the attacker physically intercepted the server's network cable and just issued themselves a cert.