This seems to be just a way to generate a wildcard cert with a custom CA with many layers of subdomain? At first I thought it was an exploit that meant it was accepted out of the box on all browsers, which would have been concerning.