1. It's not a dumb reason to revoke certs, it's a VERY good reason to revoke certs. Lot's of hosting providers allow you to register subdomains with them e.g. m

1. It's not a dumb reason to revoke certs, it's a VERY good reason to revoke certs. Lot's of hosting providers allow you to register subdomains with them e.g. mywebsite.squarespace.com; but Squarespace won't allow you to register a domain that starts with an underscore such as _123-mywebsite.squarespace.com because starting with an underscore is used for these DNS-based SSL checks. The concern was that DigiCerts system allowed you to receive an SSL cert for squarespace.com (the parent domain) by registering 12345678.squarespace.com (no underscore so as far as Squarespace knows, a normal subdomain). This is not a niche use of this; it's literally why the underscore prefix was there: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c10 https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c10 2. It is a pretty dumb thing for a website to file a lawsuit about, that is true. 3. DigiCert deserves a lot of blame for the TRO. DigiCert received one TRO for one client who had 72 certs from DigiCert[1]. What they should have done is continue with revoking the other 80,000+ certificates in the 24 hour time window and then inform the CABF that they have 72 (or however many) holdout certs caused by legally binding temporary restraining order. They should have been proactive in complying and in their communication. DigiCert did not do that though. They delayed all 80,000+ certificates for 5 days instead. That's not good enough. [1] - https://www.courtlistener.com/docket/68995396/2/alegeus-technologies-llc-v-digicert/ https://www.courtlistener.com/docket/68995396/2/alegeus-tech...