Godaddy has issued at least 8850 SSL certificates without validating anything
tl;dr: they requested a URL and wanted it to echo a token passed in the query string. They accepted 404 pages that echoed the token as valid, too!"In case anyone is wondering why this is problematic, during the Ballot 169 review process, Peter Bowen ran a check against the top 10,000 Alexa domains and noted that more than 400 sites returned a HTTP 200 response for a request to 
http://www.$DOMAIN/.well-known/pki-validation/4c079484040e32... 
[1]. A number of those included the URL in the response body, which would presumably be good enough for GoDaddy's domain validation process if they indeed only check for a HTTP 200 response.[1]: https://cabforum.org/pipermail/public/2016-April/007506.html 
"