Hacker News Reader

"(So you can't get a certificate for "login-facebook.com" or whatnot, for instance.)"

You mean not from one of those "reputable" CAs. But really, why would I go to a "reputable" CA for my deceptive certificate if my intent is not so reputable?

There's no requirement in the spec for using "reputable" CA's for certificates.

Could you provide a few examples of reputable and not so reputable CAs?

Just browse the truststore of your browser, you'd be surprised.

No, they don't. What would be the point, anyway?

Er, from personal experience I can say that at least some well-known CAs absolutely do review keywords appearing in SSL certificate requests. For a (really stupid and disappointing) example, see:

http://forums.comodo.com/ssl-certificate-b14.0/-t106480.0.ht...