Are you sure that happens in practice? Unless you have an Extended Validation certificate, which verifies the company name, I&#x27;m not aware of any requirement against fraudulent uses, or precedent of certificates revoked because of that.<p>I know certificates must be revoked if the private key leaks (e.g. Heartbleed), but who is policing certificate use? Is there any place to send complaints? Can I email StartSSL or VeriSign and ask them to revoke faceb00k.com?