4 ms·
In theory, at least, a fraud website like faceb00k.com wouldn't be able to maintain a green padlock for very long because the issuer will revoke the cert. Not
by Laaw 11y ago
In theory, at least, a fraud website like faceb00k.com wouldn't be able to maintain a green padlock for very long because the issuer will revoke the cert.
Not saying that's a solution, but it mitigates the problem somewhat.
- BoppreH 11y agoAre you sure that happens in practice? Unless you have an Extended Validation certificate, which verifies the company name, I'm not aware of any requirement against fraudulent uses, or precedent of certificates revoked because of that. I know certificates must be revoked if the private key leaks (e.g. Heartbleed), but who is policing certificate use? Is there any place to send complaints? Can I email StartSSL or VeriSign and ask them to revoke faceb00k.com?
- whacker 11y agoand what if they simply get a certificate from another source?!
- Laaw 11y ago> Can I email StartSSL or VeriSign and ask them to revoke faceb00k.com? I think so, yes. I don't have any direct evidence to back this, but my intuition is yes, they would contact the intermediary cert issuer and request the certificate be revoked due to the fraud (assuming Verisign or StartSSL were in the trust chain of the cert). Check out Trustico's website [0], where they say "Your domain name may be blacklisted and internet users will be wary to transact with your web site." [0] - https://www.trustico.com/fraud/fraud.php https://www.trustico.com/fraud/fraud.php