Osama almanna's blog: StartSSL Domain validation (Vulnerability discovered).

http://oalmanna.blogspot.com/2016/03/startssl-domain-validation.html