How to handle a digital-certificate fraud incident