The solution to this is Certificate Transparency[0], a distributed public log of certificate timestamps that are submitted by CA&#x27;s and checked by browsers.<p>CT has been required for EV certificates in Chrome for a year now[1], and eventually will be required for all certificates otherwise they will error out on connection.<p>A certificate signed by a root cert that is not the original CA will not validate.<p>[0] <a href="https:&#x2F;&#x2F;www.certificate-transparency.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.certificate-transparency.org&#x2F;</a><p>[1] <a href="https:&#x2F;&#x2F;blog.digicert.com&#x2F;certificate-transparency-required-ev-certificates-show-green-address-bar-chrome&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.digicert.com&#x2F;certificate-transparency-required-...</a>