“DigiCert says the root cause was a system update in August 2019 that led to removing automatic underscore addition in some validation paths.”
A missing underscore sat in DigiCert’s CNAME validation from August 2019 to June 2024. DigiCert fixed it by accident, in a user-experience project, and only noticed later. About 0.4% of its domain validations are affected, and customers get 24 hours to reissue. Five years of nobody checking, one day for the customers to clean up.