As described in https://www.us-cert.gov/ncas/alerts/AA19-024A the US Cybersecurity Agency warns about hackers trying to hijack DNS servers, and manipulating them to obtain SSL certificates for the hijacked domains.

This is a serious problem, since the vast majority of certificates, including CAcert’s “Class 1” certificates for non-assured members, are issued on “proof of DNS control” only.
“Extended Validation” certificates, which assure the real person or organisation controlling the domain, are not affected by this threat. But they are usually extremly expensive when requested from a commercial CA.

CAcert’s “Class 3” certificates for assured members, as well as CAcert’s Organisation Assurance are a (mostly) free alternative for those certificates, with an overall security level which is at least compareable, if not better!

Know whom to trust! Ask us on cacert@lists.cacert.org if you want to know more details!