Symantec issues more illegit HTTPS certificates

For EV CAs are already required to submit them to CT. Soon this requirement will be extended to all certs (October 2017).

In practice almost all certificates are already in a CT log, because the google crawlers submit them. But you're right: If it's about certificates purely generated for test purposes it could be that CAs that don't do CT yet can hide that.

Now, not to excuse them of anything (I shall be jumping up and down in m.d.s.policy once they write up something more substantive) I shall try to explain what they're on about

Older public CAs (and Symantec is in effect the oldest, having inherited Thawte and Versign roots) have this complicated structure with resellers and affiliates under different contracts and with varying responsibilities. Particularly for the facts about organisations, like their official address, the registered name and so on, a local business can understand things better than some remote North American corporation. So it can make sense rather than trying to build out subsidiaries in every country to instead find a partner to do that stuff.

Likewise it used to be common to out-source domain validation to third parties who were already in the domain naming game, such as registrars or hosting companies.

Now, Symantec _should_ be keeping a firm rein on these things and exercising vigilance to ensure it knows what these partners / affiliates are doing in its name. But it's much harder to do that well than to have a much simpler setup where you can see all the moving parts for yourself and reason about the whole system.

Sloppy is an oopsy. This is negligence.

1. Use domains they own.

2. Use a testing environment that doesn't issue publicly-trusted certificates.