We have to stop pretending that the #WebPKI governance is making sense.
Here's GoDaddy revoking 400k certs because they cannot follow simple compliance rules:
And this is not their first time. Has there been any consequences for them so far? Nope.
Use #DANE, pin your certs, or do anything other than relying on a "trust store" from [Mozilla|Microsoft|Google|Apple|etc].
SecurityGoDaddy revokes hundreds of thousands of certificates over documentation errorsBecause they don’t match their documentation, GoDaddy must revoke 404,607 certificates, including those used by companies such as Host Europe and DomainFactory.