The bug that prompted this was more serious: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c74 https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c74

The bug that prompted this was more serious: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c74 https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c74 Basically the missing '_' was supposed to allow DNS providers who allow programmatic DNS record creation to filter out unauthorised certificate creation. So the certificates created without it could have been unauthorized by the owner of the domain they claim to certify.