Refusing to do so reads to me like it could be conflict with the CA/B rules for certificates, but I'm not too familiar with the interpretation of these clauses. Could be an interesting question to post on the CA/B mailing list at least.

referencing Section 4.9.1.1 Reasons for Revoking a Subscriber Certificate

If CF sees OP as the subscriber of the certificate,

> The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs:

> 1.The Subscriber requests in writing that the CA revoke the Certificate

If CF considers itself the subscriber (since they are getting the certificate for their servers, this seems more likely):

> The CA SHOULD revoke a certificate within 24 hours and MUST revoke a Certificate within 5 days if one or more of the following occurs

> [...]

> 4. The CA is made aware of any circumstance indicating that use of a Fully-Qualified Domain Name or IP address in the Certificate is no longer legally permitted (e.g.a court or arbitrator has revoked a Domain Name Registrant’s right to use the Domain Name, --> a relevant licensing or services agreement between the Domain Name Registrant and the Applicant has terminated, <-- or the Domain Name Registrant has failed to renew the Domain Name);