TIL: @[email protected]'s universal certificate do not extend to subdomains of subdomains (eg: "http://qa.subdomain.mydomain.com"), seems to be a bit of a head-scratcher on that one.... why?