3 ms·
Presumably, even if you had root on the reseller website, you would need to wait for the domain owner to actually perform a domain validation before the actual
by 0x0 9y ago
Presumably, even if you had root on the reseller website, you would need to wait for the domain owner to actually perform a domain validation before the actual CA's system would deliver any certificates?
- zaarn 9y agoConsidering the security on that website, probably not. Even if you did, I would argue that if you have root access to the validation form, getting a certificate signed is not going to be exponentially harder either. Waiting for a potential target to sign a cert using that specific reseller is just borderline useless. An attacker of a CA will be interested in either their CA private key (or intermediary) or the ability to get arbitrary certs signed. Random targets on the internet are useless since it's unlikely they can MitM them.