While everybody has explained quite well what a X.509 certificate is supposed to certificate — not what some users believe it should certificate, there is another issue to take into account: how is a Certificate Authority able to know in advance what companies are fraudulent, and what are not?
Since in the democratic world, which adheres to the United Nations Declaration of Humar Rights, people are innocent until proven guilty by a court of law, certificate authorities — no matter what the size — are not supposed to be able to condemn potential criminals before they're judged as such. In other words, even the most malicious, criminal, evil organisation in the world is "allowed" to have their own website and certify its ownership, until they're convicted by a crime and ordered to shut down their website.
While this ethical issue is very, very hard to discuss (and agree!) with, because there are so many "grey areas" — thus requiring a legal framework to establish guidelines and laws — in general we can assume that certificate authorities act a bit like telephone companies and the post office: they deliver an universal service — meaning: to anybody who is a customer — no matter how "criminal" the conversation/message/packet is. A typical example: Mafia Dons have cellular phone numbers to talk to their minions, and they're allowed to do phone calls, and whatever provider they pick is required to carry their phone calls — even if they're planning murders, extorsion, prostitution, drug deals, and so on. It's not the job of the phone company to say: "you're all members of the Mob, so I won't provide you any service because you're criminals". That's up to the courts to decide (and with a successful condemnation, they may prevent mobsters to have phone numbers, and the phone companies will be notified to cancel those — if that's part of the court's sentence, of course). Similarly, you can send pharmaceutical drugs through the post service to different countries, and they will deliver your packet — it will be up to the authorities on the receiving side to check if the drugs there can be sold or not, and if not (as it happens across the EU, for example), the packet is withheld by the authorities. But it's not the post carriers that will do that. They will deliver anything — even bits of human flesh from a murder — without questioning, and will not be held responsible for doing so. On the other hand, they're bound to comply with local authorities and laws, as well as judicial decisions, to aid the police in their investigations, and to comply with whatever sentences have been applied to a convicted criminal.
While it's dubious on how far this analogy can be stretched, currently, to my knowledge, there is no law regulating certificate authorities in any way. There is body of entities validating the legitimacy of certificate authorities — essentially, the main browser manufacturers, who need to decide which CAs to trust, and which to avoid — but this body acts on its own interests and is not legally bound to any government or international regulation board.
Now, this is the factual issue: CAs are not responsible for whatever crimes are being committed by the websites that get their certificates.
Nevertheless, then we have other issues to deal with. First and foremost, CAs have a marketing department (well, not Let's Encrypt) which tells their potential customers some half-truths, namely, that "you need a certificate to get secure connections to your webserver; and, conversely, your own customers need to be able to use secure connections to find you trustworthy". Even Google (which is their own CA), with the decision of ranking https websites higher (and essentially discarding others), is sort of implying that if you have secure communications, you earn a higher degree of "trust" from Google. And, last but not least, the specialised media will have journalists and opinion makers wildly proclaiming the advantages of using a certificate to "make your website more secure and trustworthy to your customers" (possibly even pointing to Google's decision as a valid argument!).
All this together will put a certain degree on pressure on everybody to get a certificate for their website(s), because the mainstream mindset has been led to believe that encrypted communications to a website are more secure (they are) and only work with legitimate, bona fide sites (they don't), so, in a way, having a certificate means that the company or organisation is being "certified" to be trustworthy... right?
Well, no, but the subtlety of the difference — certifying the connection, not the legitimacy of the company behind the webserver! — is played down by marketing (and the media) to the point that mainstream users cannot really understand that difference at all.
And that is where we can actually make a difference: by educating the mainstream public about what a certificate means. But that needs to be done at a large enough scale to have any effect; and it has to be delievered with a very simple message which anyone can understand. Browser manufacturers may aid in that regard, by explaining what is happening with the connection, for instance. They can also install tools and services to validate the legitimacy of the websites themselves (using many third-party tools to the effect — some browsers have them built-in, others use plugins to achieve the same goal), and correctly explain that one thing is not connected to the other.
And, of course, it would also help if local governments would educate their own citizens about CAs and their certificates, but I'm aware that this is wishful thinking...