They're are already a certificate authority (they issue their own certs for google.com, etc.) and do lots of interesting "tricks" like only issuing them for 3 months at a time so they can roll them over faster as things like SHA1 get deprecated.