It's not that simple as they can backdate the cert, like StartSSL/WoSign: > It turns out WoSign has repeatedly been lying to Mozilla about backdating SHA-1 SSL

It's not that simple as they can backdate the cert, like StartSSL/WoSign: > It turns out WoSign has repeatedly been lying to Mozilla about backdating SHA-1 SSL Certificates Source: https://www.riskiq.com/blog/labs/wosign-and-startcom-caught-red-handed/ https://www.riskiq.com/blog/labs/wosign-and-startcom-caught-... Certs could be checked via Certificate Transparency but currently this is not required for DV certs.