The sysadmins at these companies must be laid off right now. Same with Windows admins using .local for their AD domain name, now you shot yourself in the foot never being able to sign some services with globally trusted certificates.

What? Many of these domains date back to when there were like 10 gTLDs and adding a new one was a rare event.

This doesn't mean you've ever been able to get signed certificates for nonexistent TLDs. If a TLD were to stop existing i would excuse the administrators who set up their systems under that domain, but if you're setting anything up that isn't under an available TLD you're doing it wrong.

RFC2606 dates to 1999, so they've had a little time to migrate. tl;dr: .test .example .invalid .localhost