I meant to imply that Dang only re-added CF recently due to the attacks. They haven't used CF in many years to my knowledge.
Cert was issued over 9 months ago.
The certificate is for *.ycombinator.com.
The main YCombinator site might have been using Cloudflare seen years, and now HN might have been added to the same account to protect from a DOS attack.
So might be the same cert?
It also means Cloudflare sees HN traffic in plaintext, including login/passwords