By proving control of the domain, there is a link between the certificate and the person asking for it thru the registrar. And thru the payment information to the registrar, you can usually get to someone.<p>It&#x27;s a tenuous link, but a lot better than  no link at all. At times enough for law enforcement to follow the tracks.<p>(edit since we reached maximum comment depth) Control of an IP address doesn&#x27;t mean trackable ownership of it, you could use any machine your just compromised and instantly have a valid certificate for it. Delays in certificate issue add a thin layer of security, even if you gained unlegitimate control of a domain, the interval before asking and getting a certificate offers an opportunity for the intrusion to be detected and remediated.<p>Instant valid certificate for any IP address you happen to compromise is really quite bad.