3 ms·

> At the end of that year, they can use the domain validation to obtain an SSL certificate that's valid for up to one year, even if they no longer control the w

• agwa 5y ago
  No, they don't have to MitM the CA's domain validation request. While they have brief control over the website, they use domain validation method 3.2.2.4.18 (Agreed-Upon Change to Website v2)[1] or 3.2.2.4.19 (Agreed-Upon Change to Website - ACME)[2] to legitimately complete domain validation by making a change to the website. Due to domain validation reuse[3], the certificate doesn't have to be issued right away. The attacker can wait and request the certificate up to 398 days later, without having to do domain validation again. [1] https://github.com/cabforum/servercert/blob/cda0f92ee70121fd5d692685b97ebb6669c74fb7/docs/BR.md#322418-agreed-upon-change-to-website-v2 https://github.com/cabforum/servercert/blob/cda0f92ee70121fd... [2] https://github.com/cabforum/servercert/blob/cda0f92ee70121fd5d692685b97ebb6669c74fb7/docs/BR.md#322419-agreed-upon-change-to-website---acme https://github.com/cabforum/servercert/blob/cda0f92ee70121fd... [3] https://github.com/cabforum/servercert/blob/cda0f92ee70121fd5d692685b97ebb6669c74fb7/docs/BR.md#421-performing-identification-and-authentication-functions https://github.com/cabforum/servercert/blob/cda0f92ee70121fd...