I needed to create valid HTTPS certificate once, as a project to setup MITM proxy and test various applications verification of domain. I just created an account on <a href="https:&#x2F;&#x2F;www.startssl.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.startssl.com&#x2F;</a> with totally fake identity, found some place to register a free domain and got a certificate at zero cost within a few hours. Maybe Let&#x27;s Encrypt makes it easier to automate, maybe they need to add a CAPTCHA (what for?), but the possibility of creating valid HTTPS certificates for malicious uses was already there.<p>Banks and employers should just teach users to look for green icon near the URL, not just a padlock.