This is just a symptom. The underlying problem is the whole model of the SSL PKI. To quote Ivan Ristic's Bulletproof SSL and TLS: > There’s an inherent flaw in

This is just a symptom. The underlying problem is the whole model of the SSL PKI. To quote Ivan Ristic's Bulletproof SSL and TLS: > There’s an inherent flaw in how Public Key Infrastructure (PKI) operates today: any CA is able to issue certificates for any name without having to seek approval from the domain name owner. It seems incredible that this system, which has been in use for about 20 years now, essentially relies on everyone—hundreds of entities and thousands of people—doing the right thing. My hope is that in time we will move to something like DANE[1]. [1]: <https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities> https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...