&gt; it&#x27;s not the job of SSL to ensure a domain name is not owned by someone it shouldn&#x27;t be.<p>That&#x27;s correct. CAs checked identity back in the 90s, but stopped and moved to domain validation for most certificates. The article mentions explicitly: the certificates aren&#x27;t fake, they&#x27;re just DV, and that&#x27;s what DV is. Obviously most consumers have no idea about that, and have been conditioned to trust any kind of SSL.<p>The main issue asides from most consumers having no idea what DV is, is that Section 4.2 of the baseline requirements - which applies to all CAs - asks CAs to check for &#x27;high risk&#x27; domains. That&#x27;s clearly broken here.<p>Certificate transparency records for the domains in question:<p><a href="https:&#x2F;&#x2F;crt.sh&#x2F;?q=google.com.%25" rel="nofollow">https:&#x2F;&#x2F;crt.sh&#x2F;?q=google.com.%25</a>