I needed to create valid HTTPS certificate once, as a project to setup MITM proxy and test various applications verification of domain. I just created an accoun

I needed to create valid HTTPS certificate once, as a project to setup MITM proxy and test various applications verification of domain. I just created an account on https://www.startssl.com/ https://www.startssl.com/ with totally fake identity, found some place to register a free domain and got a certificate at zero cost within a few hours. Maybe Let's Encrypt makes it easier to automate, maybe they need to add a CAPTCHA (what for?), but the possibility of creating valid HTTPS certificates for malicious uses was already there. Banks and employers should just teach users to look for green icon near the URL, not just a padlock.