A vulnerability in the automation-controller instance install-bundle endpoint allows a system administrator to obtain a long-lived, non-revocable mesh-CA-signed certificate for a case-variant hostname. This certificate can be accepted by TLS peers that match hostnames case-insensitively, enabling potential TLS impersonation or interception in managed/hosted deployments. The flaw arises from inconsistent case sensitivity in hostname validation and the lack of issuance logs or revocation mechanisms. It does not allow direct remote code execution.