Comment 232 for bug 232340

"then presumably such large
damage can be mitigated by such a web site selecting a CA that Mozilla trusts"

That is not an option for everyone.
Please name me one cheap or free CA that supports
vhosts (SubjectAltName) that is trusted by Mozilla.
Having more then one domain on one IPv4 is quite
common and it works very fine with CACert but
commercial ones charge you an arm and a leg for this
(every year and every time a subdomain is added/removed).