This is not permitted by Comodo's policy. I am going to report this to Comodo. Edit: contacting Discord first to let them know that they need to change this.

This is not permitted by Comodo's policy. I am going to report this to Comodo. Edit: contacting Discord first to let them know that they need to change this. Please see the recent discussion on this practice (which mentions Discord): https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/eV89JXcsBC0 https://groups.google.com/forum/#!topic/mozilla.dev.security... Follow-up: I wrote to Discord to point out this m.d.s.p thread to them and am holding off on my report to Comodo to wait to hear back from Discord about their intentions. Note that section 6.1.2 of the CA/Browser Forum Baseline Requirements says "If the CA or any of its designated RAs become aware that a Subscriber’s Private Key has been communicated to an unauthorized person or an organization not affiliated with the Subscriber, then the CA SHALL revoke all certificates that include the Public Key corresponding to the communicated Private Key."