How does Let's Encrypt prevent imposters?

Question

Because Let's Encrypt doesn't provide Entity Validation, is it true that one can, for example, generate a certificate that has "Facebook Inc." as Organization for a bogus domain faceb00k.com?

Answer 1

Although Let's Encrypt issues domain-validated certificates and these guarantee only that a certificate was requested by an entity owning the domain, it does have policies in place to prevent imposters in certain cases.

According to the stipulation "3.2.4.3 Verification against High Risk Certificate Requests" in "ISRG Certification Practice Statement" (v1.4, May 5, 2016):

To prevent potential phishing, fraudulent use and to take further precautions against potential compromise, The CA maintains a list of prior high risk requests and checks a third-party authority list specifying current high risk Domain Names. This list is used by servers to identify potential risks. Should an application with any potential risk posed to the CA or a Domain Name listed on the third-party authority list, it will be flagged and brought to the attention of management to complete further internal verification. To prevent high-risk Issuance of a DV-SSL Certificate this internal verification will require one or more the following pieces of evidence:

• Request further documentation confirming control of the domain from the Applicant;
• Careful examination of the FQDN to confirm whether the intent of the Domain Registrant or Applicant is to imitate or mislead customers of an FQDN on the high risk third party authority list in order to commit fraudulent or phishing activities (e.g. www.g00gle.com, www.1dentrust.com, etc.) and specific filters that are established at the system level to deny initial applications (e.g., non-US ASCII characters);
• Manual review of all information provided in the online application form; and/or
• Other verifiable proof as deemed necessary by the CA management.

According to the above it is (very likely) not true that you could obtain a certificate for faceb00k.com.

---

Regardless of that, Let's Encrypt certificates have only the Common Name value set to a verified domain (e.g. CN=example.com), so you could never get a certificate from them with O=Facebook Inc., even for a domain not subject to the above verification process.