No possible way to renew once TLS-SNI validation goes away

[mdhardeman]

@schoen

Unfortunately, this is in tension with some efforts by the CA industry to give management—in the form of network administrators representing domain owners—more control over the ability to issue certificates. “We don’t want to have to ask the domain owner before getting a certificate” isn’t a case that the industry is very friendly to, even though in your case your intentions are entirely non-malicious.

I agree. While I understand the user's dilemma and sympathize, there is a good case to be made that, in fact, such a certificate should not issue. If there's hesitation to seek the active permission of the domain holder, this suggests against issuance.