> This is the certificate used to verify the identity of the cloud server. The file contains the “VeriSign Class 3 Public Primary Certification Authority – G5”

> This is the certificate used to verify the identity of the cloud server. The file contains the “VeriSign Class 3 Public Primary Certification Authority – G5” root certificate. This means the only check performed when establishing a TLS connection to the cloud is if the provided server certificate has been signed by the Symantec/VeriSign CA for Extended Validation (EV) certificates (CA pinning). A determined attacker could buy his own EV certificate and use it to impersonate a cloud server. This part I don't get. Do they mean the firmware verifies the CA but NOT that the cert is actually for the domain/CN they want? If they made such a glaring mistake I would expect the write up to say it explicitly. The way this is written seems to imply that all you need to impersonate a server is to buy a cert from the same CA it uses, which is obviously not the case.