And even then, they might grant you a certificate for a domain one day, and the next time you renew or even pay for a revocation (think heartbleed), they may pu

And even then, they might grant you a certificate for a domain one day, and the next time you renew or even pay for a revocation (think heartbleed), they may put it on the revocation list and then proceed to delay for a manual review for hours or even days, and then decide your random domain is registered by your client instead of yourself, and you cannot renew even if you can prove domain validation. They used to be cool, but recently they have become a major hassle to the point where it's faster and easier to just pay per certificate at more conventional CAs like those reselling instantssl. If your time has an hourly price, you'll probably even save money. Edit: I'm sure it's a noble goal that they do not want to certify domains they cannot prove are owned by the customer, but it doesn't really do much good in practice when the CA next door will happily issue a certificate as long as you can read administrative email for the domain.