DigiNotar Damage Disclosure (with full list of issued certs)
<p><pre><code>  The most egregious certs issued were for *.*.com and *.*.org
</code></pre>
Why is that even possible? Does it ever make sense for that to exist? If the browsers currently accept that, I wouldn't be surprised if they stop accepting that since it almost certainly means someone got ahold of certs they shouldn't have.