[tptacek]

Neat! I'm surprised and happy this works; I presumed the Apple SSL framework would only check the trust setting on the root.

Unfortunately, you can't (as far as I can tell) do this with Firefox; import the Comtrust certificate and turn off "use to validate websites", restart Safari, and it'll still accept the Etisalat site.

What does work is to take the CER file, pop it open in a hex editor, whack 1 byte of it, and import that; the result is a mismatched certificate error on sites signed by Etisalat/Comtrust.