The SAN field on the certificate for bitcoin.de is pretty interesting:
Or maybe not, maybe they need to be able to read the traffic in order to be able to filter out ddos attacks..
DNS Name=ssl2669.cloudflare.com
DNS Name=*.ukashvip.com
DNS Name=ukashvip.com
DNS Name=bookmakers.com.au
DNS Name=*.calendars.com
DNS Name=calendars.com
DNS Name=subeta.net
DNS Name=*.subeta.net
DNS Name=*.goldenarium.com
DNS Name=*.hellocq.com
DNS Name=*.bookmakers.com.au
DNS Name=*.pcbooster.com
DNS Name=*.hosthack.com
DNS Name=hosthack.com
DNS Name=*.aitec.ee
DNS Name=greenpolkadotbox.com
DNS Name=pcbooster.com
DNS Name=goldenarium.com
DNS Name=testwanda.com
DNS Name=bitinstant.com
DNS Name=*.testwanda.com
DNS Name=bitcoin.de
DNS Name=*.bitcoin.de
DNS Name=president.gov.ph
DNS Name=*.greenpolkadotbox.com
DNS Name=aitec.ee
DNS Name=*.president.gov.ph
DNS Name=*.bitinstant.com
DNS Name=hellocq.com
DNS Name=*.tangostress.info
DNS Name=tangostress.info