[Sir_Substance]

>There is no minimal to extensive checking. That is a scam.

You generally have to modify the root domain to host a random value in a text file the cert company gives you. This demonstrates that you have control of the domain.

Aka, minimal checking.

Granted, that doesn't prove that you're the domain owner, but if you aren't the domain owner and you've got enough access to pass that challenge, the real own has security problems a cert isn't going to fix so hey.

All things considered, it's a hell of a lot better than nothing.