Andrew misunderstands the purpose of including CloudFlare in the cert. He thinks its to easily identify the CA. The ICA is not used that way. In this case, Cloudflare is the one managing all of the certificates issued off this change. If you have an issue with the certs, you know Cloudflare is the one managing it. He says “its completely useless for human consumption”, but that’s just more of the same misunderstanding. Afterall, would you rather know that all the sites are being operated by Cloudflare or know that DigiCert issued the cert? The average person doesn’t care who issued the cert – they care about who is managing the certs.

The name of the root is to indicate ubiquity, not to provide identification of the CA who is operating it. If you need to know whether a cert will work on an older platform, you look at the name of the cert embedded, not the serial number. Its faster and easier to do so. You also want to know when things will expire and when you might need to migrate CAs. That’s best done with the name of the root. Plus – this is how browsers track which roots are trusted. Browsers could tie to the serial number, but they use the subject info of the cert for identification purposes on what roots are included and what roots are audited.

In summary, he has misguided notion about why these values are in the certs and the value they provide. He sees no value in them because he assumes people will be looking at the ICA and root purely to contact the CA, when that is rarely the case. I dont think there is a security or real issue with the information.