Just saw on V2EX that someone exploited a vulnerability in WoSign's certificate issuance system to successfully issue a certificate for GitHub's main domain. https://crt.sh/?id=29647048 Certificate: Data: Version: 3 (0x2) Serial Number: 5d:8f:2b:91:ef:b8:dd:65:af:4c:c1:2b:15:ef:4b:6e Signature Algorithm: sha256WithRSAEncryption Issuer: commonName = WoSign CA Free SSL Certificate G2 organizationName = WoSign CA Limited countryName = CN Validity Not Before: Jun 10 05:42:44 2015 GMT Not After : Jun 10 06:03:35 2018 GMT Subject: commonName = schrauger.github.io Subject Public Key Info: Public Key Algorithm: rsaEncryption Public-Key: (2048 bit ) Modulus: 00:e4:3b:a1:76:73:3c:b1:62:8d:53:6d:ef:a8:e9: 5b:9e:0e:15:63:e6:57:ac:cc:31:b3:48:2b:01:74: ae:d8:7d:1c:6b:ed:2a:40:45:36:62:83:ac:d7:a5: 80:...