Clever trick allows attackers to obtain valid TLS certificate for hijacked domains.