4 ms·

Flaw in StartSSL Validation Allowed Attackers to Get SSL Certs for Any Domain

• 0x0 11y ago
  Wasn't this dismissed as incorrect? The extra email address was the one listed in WHOIS and used to be a valid option in the web UI, and is a reasonable choice for issuing domain-validated certs?
  • iriche 11y ago
    I remember the same thing, and as above - already been discussed a lot
  • leeoniya 11y ago
    StartSSL's response: https://www.startssl.com/NewsDetails?date=20160322 https://www.startssl.com/NewsDetails?date=20160322
• aroch 11y ago
  Previous discussion: https://news.ycombinator.com/item?id=11330877 https://news.ycombinator.com/item?id=11330877