You are paying the CA for the service of verifying your CSR against public records, and putting their reputation on the line for you. I'm not sure if a CA is contractually obliged to provide you service. Is a lawyer required to represent you in court as soon as you walk into their office?
I would assume that a CA has the authority both to:
- Refuse to certify any CSR for any reason they see fit.
- Revoke any certificate at any time, for any reason they see fit.
I can see why this would cause some public concern in a post-Snowden world. Let me assure you that (to the best of my knowledge) CAs are private companies acting out of their own economic self-interests with no government affiliations, and that the public SSL roots are routinely audited by many industry and multi-national government panels looking for that kind of fraud. A CA that is caught doing something dirty will go out of business very very quickly.
As @Matthew said in the top answer to the linked question, the whole system works on
Peer pressure, effectively.
[Disclaimer since I've been accused of bias before; I work for a CA]
Although it's not in your question, I would like to draw a distinction between Domain Validated certs and Extended Validation certs.
A DV cert will cost you 0$ - 5$, and the issuance is completely automated: you just need to prove that you own the DNS registry, and that you can place a file on the server that responds to that IP address. While there is no guarantee that this is free of political influence, it's pretty safe.
EV certs involve humans and paperwork and phone calls and stuff. This is the one where your suspicions might be justified.
Given that DV certs are so easy to get, your fear that a CA (or political consortium of CAs?) can de facto block a website from operating is not really justified - as long as you're ok with the plain-old-padlock, not the super-green-bar.