Godaddy has issued at least 8850 SSL certificates without validating anything
tl;dr: they requested a URL and wanted it to echo a token passed in the query string. They accepted 404 pages that echoed the token as valid, too!<p>"In case anyone is wondering why this is problematic, during the Ballot 169 review process, Peter Bowen ran a check against the top 10,000 Alexa domains and noted that more than 400 sites returned a HTTP 200 response for a request to 
<a href="http://www.$DOMAIN/.well-known/pki-validation/4c079484040e32529577b6a5aade31c5af6fe0c7" rel="nofollow">http://www.$DOMAIN/.well-known/pki-validation/4c079484040e32...</a> 
[1]. A number of those included the URL in the response body, which would presumably be good enough for GoDaddy's domain validation process if they indeed only check for a HTTP 200 response.<p>[1]: <a href="https://cabforum.org/pipermail/public/2016-April/007506.html" rel="nofollow">https://cabforum.org/pipermail/public/2016-April/007506.html</a> 
"