> it's that their many customers can't update their DNS records fast enough to point to the new certs. This is almost certainly wrong. With the exception of DN

> it's that their many customers can't update their DNS records fast enough to point to the new certs. This is almost certainly wrong. With the exception of DNSSEC, there's no interaction between DNS and certificates. There's no DNS record that points at a certificate. The HTTP server that terminates the connection is the server that has the certificate. TXT records can validate a domain, but you can also validate a domain by hosting a file on that domain to show that you control it. I find it more likely that Alegeus is giving customers appliances or VMs that they run themselves, and those are each configured with a baked-in certificate. Which is bad anyway because it means the customer needs to be involved in the certificate update process.