4 ms·

I tried using CloudFlare for my site, but they (or their CA partner) wouldn't issue a certificate for my domain (piranhas.co) because it contains the substring

by k33l0r 11y ago

I tried using CloudFlare for my site, but they (or their CA partner) wouldn't issue a certificate for my domain (piranhas.co) because it contains the substring “iran”. Seriously[0]. [0]: https://twitter.com/matiaskorhonen/status/561063104596172800 https://twitter.com/matiaskorhonen/status/561063104596172800

r1ch 11y ago
I had the a similar problem, they refused to issue a certificate because the domain had a trademarked word in it. Seems strange they would be the ones to enforce trademarks, but I guess it could be considered as an anti-phishing measure or something.
- prdonahue 11y ago
  This is a relic of the CA/B Forum (https://cabforum.org/ https://cabforum.org/) delegating review of brand/trademark checks to the CAs. We (CloudFlare) send hostnames to the CA for issuance and they check against internal lists, holding up anything for manual review that may violate another's trademark or be used for phishing (e.g., "pavpal" with a 'v' rather than a 'y'), etc. Each CA has their procedures but most look at data sources like the Alexa Top 1000, and specific requests from high value targets like Microsoft, Google, etc. In some cases, e.g., Microsoft, the CAs must actually reach out to specific contacts at those firms before they can issue. In other cases, they manually review and release to us.
derekp7 11y ago
So 20 years later we are still stuck with this: https://en.wikipedia.org/wiki/Scunthorpe_problem https://en.wikipedia.org/wiki/Scunthorpe_problem ?
- mikeash 11y ago
  It's always going to be around in some form, it's a clbuttic problem.
- Already__Taken 11y ago
  A daily saga for anyone who is stuck administering censorship.
middleclick 11y ago
Did CF follow up after that?
- Gigablah 11y ago
  Seems like CF didn't respond for 24 days after the initial exchange, and they haven't responded to his final tweet either.
  - prdonahue 11y ago
    While we often make announcements there, Twitter isn't an official support channel. Requests should be filed at https://support.cloudflare.com https://support.cloudflare.com where they can be tracked and responded to directly.
- k33l0r 11y ago
  Nothing since then. I moved on and aren't inclined to go back to CloudFlare.
prdonahue 11y ago
Unfortunately, the CAs have their policies and we must adhere to those. We're working, however, on ways to better (and automatically) communicate with them when we encounter false positives. In this particular case, yes, some have very basic string matching for keywords like "iran" -- but in these scenarios we can (and do) request them to recheck by hand. Your particular request should have been handled in less than 24 hours (or shorter, if non-free plan). The process for some of them is more manual than we'd like, but a support request can be filed to expedite if this happens again. - CloudFlare's PM for TLS

by k33l0r 11y ago

r1ch 11y ago

I had the a similar problem, they refused to issue a certificate because the domain had a trademarked word in it. Seems strange they would be the ones to enforce trademarks, but I guess it could be considered as an anti-phishing measure or something.

prdonahue 11y ago
This is a relic of the CA/B Forum (https://cabforum.org/ https://cabforum.org/) delegating review of brand/trademark checks to the CAs. We (CloudFlare) send hostnames to the CA for issuance and they check against internal lists, holding up anything for manual review that may violate another's trademark or be used for phishing (e.g., "pavpal" with a 'v' rather than a 'y'), etc. Each CA has their procedures but most look at data sources like the Alexa Top 1000, and specific requests from high value targets like Microsoft, Google, etc. In some cases, e.g., Microsoft, the CAs must actually reach out to specific contacts at those firms before they can issue. In other cases, they manually review and release to us.

derekp7 11y ago

So 20 years later we are still stuck with this: https://en.wikipedia.org/wiki/Scunthorpe_problem https://en.wikipedia.org/wiki/Scunthorpe_problem ?

mikeash 11y ago
It's always going to be around in some form, it's a clbuttic problem.
Already__Taken 11y ago
A daily saga for anyone who is stuck administering censorship.

middleclick 11y ago

Did CF follow up after that?

Gigablah 11y ago
Seems like CF didn't respond for 24 days after the initial exchange, and they haven't responded to his final tweet either.
- prdonahue 11y ago
  While we often make announcements there, Twitter isn't an official support channel. Requests should be filed at https://support.cloudflare.com https://support.cloudflare.com where they can be tracked and responded to directly.
k33l0r 11y ago
Nothing since then. I moved on and aren't inclined to go back to CloudFlare.

prdonahue 11y ago

Unfortunately, the CAs have their policies and we must adhere to those. We're working, however, on ways to better (and automatically) communicate with them when we encounter false positives. In this particular case, yes, some have very basic string matching for keywords like "iran" -- but in these scenarios we can (and do) request them to recheck by hand. Your particular request should have been handled in less than 24 hours (or shorter, if non-free plan). The process for some of them is more manual than we'd like, but a support request can be filed to expedite if this happens again. - CloudFlare's PM for TLS