Unicode domain names issue (Encrypting a "fake" domain name)

I was led today to this article - https://www.wordfence.com/blog/2017/04/chrome-firefox-unicode-phishing/ - about the domain name 'www.epic.com' which can be written using unicode as 'www.xn--e1awd7f.com' to make a fake website look exactly like the URL of the real website.

There is a work around in Firefox for this, but possibly more seriously:

LetsEncrypt has a valid encryption certificate for the fake domain, and in Firefox the domain certificate (when clicking on the padlock icon to view the drop down box) still shows the processed unicode URL rather than the "raw" URL (showing that the Encryption certificate is for "epic.com" rather than "xn--e1awd7f.com" which is the domain given to LetsEncrypt).

This issue is clearly quite serious that certificate names can be manipulated to look like other names in certain situations, further undermining the value of the certificate as an authenticity check. 

I would like this post to be a warning, and a sharing of this information, however the issue may well lay at the hands of browsers, but Certificate Authorities should have a premise with Browsers that their certificate addresses can and should only be shown in a set character set and never ever "interrepted" by the browser. 

Article date: 14th April 2017.

Links:


- https://www.wordfence.com/blog/2017/04/chrome-firefox-unicode-phishing/

- https://www.xudongz.com/blog/2017/idn-phishing/

- https://www.reddit.com/r/netsec/comments/65csdk/phishing_with_unicode_domains/