Add revoked intermediate subdomain

[rugk]

See https://revoked-intermediate.serverhello.com/ for an example.

[lgarron]

Hmm, revoked certs are tricky, and intermediates doubly so. How did https://revoked-intermediate.serverhello.com/ get a cert revoked intermediate, and what's the story behind the revocation?

Also, revocation on its own usually doesn't trigger a failure (with notable exceptions, e.g. EV in Chrome and must-staple), although I at least want to get revoked.badssl.com (#30) into Chrome's CRLSet at some point.

[rugk]

Ask @selecadm.

https://twitter.com/selecadm/status/682656650839371777

[selecadm]

This cert was issued after intermediate revocation but before SHA1 was disallowed.

Now all I can come up with is pinging @robstradling, whether it's possible to issue SHA2 from SHA1 discounted intermediate, or create and then revoke new intermediate. The second option would be much better, considering it would be the first intermediate in chain. My setup makes use of cross-signing.

[gdubicki]

+1