Comment by yusaydat

They asked users of the VPN service to install a certificate, that's how they did it.