If I disagree with Let's Encrypt's cavalier attitude about SSL certificate issuance, and their indifference to their auto-generated certificates potentially being using for widespread criminal activities, how can I automatically disable all of my organization's web browsers and other software that uses internally stored lists of certificate authorities, from accepting their certificates and preventing end-user exposure to the threat of phishing sites using Let's Encrypt SSL?
Let's Encrypt has abdicated all responsibility for HTTPS / SSL to be used to validate the authenticity of a website and its content as valid.
Although it is possible to abuse certificates from standard authorities, there is a revocation process in place to deal with that. When a bad actor has been identified and they lose their certificate, it is an expensive and time-consuming process for the bad actor to obtain a new replacement to begin scamming again. The bad actor will of course be banned from using the previous CA, which will tell other CA's what happened, and so the criminal has to find another unrelated CA... and then another... etc.
But Let's Encrypt has thrown all this out the window, stating that the potential for criminal abuse of their easily auto-distributed free SSL certificates are just Not Their Problem, and they're not going to bother with trying to prevent it.
Due to the fact that certificate authorities are authorized via a process that involves individual web browsers without any other local infrastructure, it would seem that revoking Let's Encrypt across all devices in my organization may require manual intervention on every web browser or operating system that uses an internally stored list of trusted global certificate authorities.