It appears this was first discovered right here on Hacker News by user JXzVB0iA: https://news.ycombinator.com/item?id=45089708 https://news.ycombinator.com/item

It appears this was first discovered right here on Hacker News by user JXzVB0iA: https://news.ycombinator.com/item?id=45089708 https://news.ycombinator.com/item?id=45089708 Note that the CA which did this is trusted only by Microsoft. The other major root programs (Mozilla, Chrome, Apple) manage their root programs much better and don't trust CAs like this. Also, this CA is part of the EU's Trust List, so had the EU's original eIDAS/QWAC proposal gone through, Mozilla, Chrome, and Apple would have been required by EU law to trust this CA also.