In some browsers, certificate revocation or certificate status checking is turned off by default. If this is the case, turn it on. When a CA detects a problem certificate, it will revoke the credential. The only way your browser can determine if a certificate has been revoked--and warn you about it--is if the status checker is activated.

3. Customize the root certificates in your browser.

Most browsers include a number of "root certificates" in them by default. Such credentials act as blanket permissions to accept all the certificates from a CA. For example, in the recent DigiNotar case, a root certificate for that CA installed on a browser would allow any certificates issued by the CA to be automatically trusted--even fake ones. Recognizing that, the major browser makers--, and --swiftly removed the DigiNotar root certificate from their products. In some browsers, you can manually disable root certificates, although this may push your technological savvy and patience. There can be more than 100 roots in a browser and editing the trust settings in each one can be very time consuming.

4. Always look for the green bar inside your browser's address bar.

That's a sign that the certificate for the URL in the address bar has been subjected to an "extended validation" process. Not all websites have them, but many high-profile sites do. "That's your assurance that the certificate holder has gone through a very rigorous, documented process of authentication and vetting," Symantec Technical Director Rick Andrews explained to PC World. "By definition EV certs can't be instantly issued. They have to be vetted by humans."