For instance, you might want to accept an akamai cert for some given domain that is known to be served by akamai. This might require [an API that doesn't exist yet](https://bugzilla.mozilla.org/show_bug.cgi?id=644640) or it might be possible via [the browser's whitelisting mechanism](https://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/public/nsICertOverrideService.idl) in combination with [nsIBadCertListener2](https://mxr.mozilla.org/mozilla-central/source/security/manager/ssl/public/nsIBadCertListener2.idl) or [something equivalent](https://bugzilla.mozilla.org/page.cgi?id=splinter.html&bug=700693&attachment=747679)