What if someone hijacks a domain? Should they issue one then?

I'll say this, I don't want to see "Let's Encrypt" go on some moral crusade deciding not to grant a certificate to a website because that website contains offensive content, but their job is to verify at least somewhat the identity of the requester to try and stem impersonation.

> What if someone hijacks a domain?

But that's a registrar problem, not a "proof that this connection comes from someone who controls that domain" problem. These aren't EV certificates.

Part of HTTPS is making sure that the person you're talking to is the person you think you're talking to.

That's what EV certificates are for.

Otherwise https only gurantees that you're actually talking to the domain you see in the URL, not who that domain belongs to.

The fact that I seized a domain ten years ago doesn't mean I'm not who I say I am today.

Also, seizure and hijacking aren't equivalent.

What if a domain expires but a certificate for the domain has been issued by the previous owner?

I would think a cert shouldn't be issued with an expiration date after that of the domain registration itself.

That would work with common gTLDs, but some ccTLDs have a very annoying policy where they only allow one-year renewals and the renewal doesn't show up in the whois until the last moment.

Anyway, it's trivial to find out whether a domain was expired and re-registered. The date of initial registration in the whois will change, so you can just compare it with the value you saw when you first issued a certificate for that domain.