How Oh Dear identified a certificate problem at a large CDN provider

Oh Dear's SSL certificate monitoring checks every 30 minutes per site, which allowed it to detect a misconfiguration at a large CDN provider where some edge servers were returning their own wildcard certificate instead of the customer's certificate. The post explains how the issue was discovered through SNI-based certificate fetching, how Oh Dear improved its tooling to expose the specific IP address used during checks, and how they collaborated with the CDN provider to identify and fix two misbehaving edge servers across thousands worldwide.