As an anecdote, I once sent a vulnerability report to Microsoft that it was possible to get a certificate in Azure for a domain you didn’t control and have it v

As an anecdote, I once sent a vulnerability report to Microsoft that it was possible to get a certificate in Azure for a domain you didn’t control and have it validated with a third domain that was attacker controlled. They rejected it on the basis that they do not investigate any vulnerabilities that require man-in-the-middle to exploit. Seriously!?