That was my first instinct as well!

I reached out to Digicert at [email protected]. They responded almost immediately and directed me to Cloudflare's abuse report form, where I was met with a wall. Now I'm back to Digicert asking them to please revoke them.

Note that this isn't an urgent security situation, as the domain in question isn't in use currently. It's more of an annoyance, since the certs are valid for 1 year.

Certificates in question: https://crt.sh/?id=11447235791 https://crt.sh/?id=11447092451

This is actually very interesting. Please let me know what digicert says once you say your request again. If they push back on this I’ll escalate it with your permission.

I see the still haven’t revoked your cert. Has digicert started the revocation process?

I tried replying to the existing email thread which did not get a response. Tomorrow I'll attempt starting a new case, with a more clearly worded request. I'll let you know how that goes.

Great success. This time it went without any issues and got the certificates revoked within 6 hours of my first email.

Awesome!