tl;dr: Thawte (owned by Symantec) issued a "pre-certificate" for an EV certificate for google.com and www.google.com without consulting Google. Google noticed

tl;dr: Thawte (owned by Symantec) issued a "pre-certificate" for an EV certificate for google.com and www.google.com without consulting Google. Google noticed this when it showed up in Certificate Transparency logs, and Symantec asserted it was created during internal testing of their systems. For anybody else who didn't know what a "pre-certificate" was, https://tools.ietf.org/html/rfc6962#section-3.1 https://tools.ietf.org/html/rfc6962#section-3.1 : Anyone can submit a certificate to any log. In order to enable attribution of each logged certificate to its issuer, the log SHALL publish a list of acceptable root certificates (this list might usefully be the union of root certificates trusted by major browser vendors). Each submitted certificate MUST be accompanied by all additional certificates required to verify the certificate chain up to an accepted root certificate. The root certificate itself MAY be omitted from the chain submitted to the log server. Alternatively, (root as well as intermediate) certificate authorities may submit a certificate to logs prior to issuance. To do so, the CA submits a Precertificate that the log can use to create an entry that will be valid against the issued certificate.