> The better question is, how do you prevent this tactic from working? Make it clear that if it works, it will only work once. The CABF should adopt policies

> The better question is, how do you prevent this tactic from working? Make it clear that if it works, it will only work once. The CABF should adopt policies that any such legal action or any request for extension will be considered a public declaration that the customer's application is incompatible with the requirements of the Web PKI and that not only will the current CA refuse to renew the certificate but it will be publicly documented in the Bugzilla so that no other CA will issue certificates covering any of those names nor any new names for the same company without an affidavit explicitly stating that the issues preventing compliance have been resolved and the company acknowledges this and commits to never doing so again. Existing names that were successfully revoked in time can be renewed but neither the problematic one(s) nor any new ones will be allowed. If they then file for another TRO in the future they may still get a short-lived order but the existence of such an agreement would at least to my non-lawyer brain cause any judge who may have granted a TRO to become very displeased when the CA presented it in their response.