3 ms·
If you read the report linked from the bugzilla, you will read: One of the methods that Comodo uses to validate that a certificate applicant owns or controls a
by 45h34jh53k4j 10y ago
If you read the report linked from the bugzilla, you will read:
One of the methods that Comodo uses to validate that a certificate applicant
owns or controls a domain to be included in the subjectAlternativeName of a
server authentication certificate is set out in the CA/B Forum's Baseline
Requirements document [2] at section 3.2.2.4.2.
That method may be summarized as the sending of an email to an email address
(and obtaining a confirming response) where the email is identified as
belonging to the Domain Name Registrant, technical contact, or
administrative contract as listed in the WHOIS record of the domain.
So the Browser (Google Mozilla Microsoft) and the CA (Comodo Symantec LE) industry working group agreed that was acceptable.
- zokier 10y agoMaybe it is time to review that policy. As far as I can tell, WHOIS protocol and data are both completely unauthenticated, and as such relatively easily manipulated by mitm.
- 45h34jh53k4j 10y agoRDAP over https should be fine
- zokier 10y agoAnd if RDAP or whatev would have been used here then the whole problem would have never occurred. But it wasn't, due not being required to. Ergo sum, the requirements should be reviewed to avoid repeating this sort of thing.
- pfg 10y agoBaseline Requirements also allow domain validation via DNS or a HTTP request. Essentially all domain validation methods break down once you're in a position to MitM the CA.