"paypal.com in the name" is a bit too ambiguous. You can register a subdomain like "paypal.com.example.com" and acquire a certificate for that, that's correct.

"paypal.com in the name" is a bit too ambiguous. You can register a subdomain like "paypal.com.example.com" and acquire a certificate for that, that's correct. There have been no mis-issuances under the actual domain "paypal.com", to my knowledge. Here's a blog post explaining why Let's Encrypt does not think it should be the CA's job to prevent this[1]. At least two browser vendors seem to share this sentiment[2][3]. [1]: https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html [2]: https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/4Xy1Q6PHA7Y/-OcrrsTqCAAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p... [3]: https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/vMrncPi3tx8/M-U5F8K7AQAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p...