TLS certificates were almost never particularly well verified

The article discusses the inadequacies of TLS certificate verification, highlighting a recent incident where researchers exploited weaknesses in the validation process. It reveals that many TLS Certificate Authorities (CAs) have historically relied on WHOIS information for domain validation, which can be manipulated if someone gains control of a WHOIS server. The author argues that CAs have never performed rigorous identity verification for TLS certificates and suggests that a thorough verification process would be costly and impractical. The shift towards cheaper TLS certificates, particularly after the introduction of Let's Encrypt and the ACME protocol, has further diminished the quality of verification. The article concludes with a note of optimism that the reliance on WHOIS for domain verification may soon be phased out, although the timeline for this change remains uncertain.

- TLS certificate verification has historically been weak, relying on easily manipulated WHOIS data.

- Thorough identity verification for TLS certificates is costly and impractical for Certificate Authorities.

- The introduction of cheaper TLS certificates has led to a decline in verification quality.

- There is potential for the phasing out of WHOIS-based verification in the future.