It's not a root certificate in the CA sense. It can't sign new certificates and is only for the browser to communicate to the https server running on the same c

It's not a root certificate in the CA sense. It can't sign new certificates and is only for the browser to communicate to the https server running on the same computer. The key isn't even distributed anywhere. It's generated locally and then marked trusted so the browsers don't show warnings. Checking the list of certificates from time to time is a good idea, although I wonder if anyone really does that very often without some automated help, but in this case Blizzard was doing something that was not only fine (using a self-signed cert to secure local traffic) but the absolutely correct way to do this. (As additionally explained by Let's Encrypt themselves) edit: I guess the one thing is: If you can find the certificate's private key you can serve your own server at that domain and launch an attack using a trusted certificate without needing admin permission to add your own malicious certificate.