4 ms·
Which CA is this? Contact their CPR endpoint and tell them you want it revoked. Don’t bother going through Cloudflare. If they don’t respond to you within 24
by aaomidi 2y ago
Which CA is this? Contact their CPR endpoint and tell them you want it revoked.
Don’t bother going through Cloudflare.
If they don’t respond to you within 24 hours, let me know and we can start an incident against that CA.
- hurutparittya 2y agoThat was my first instinct as well! I reached out to Digicert at revoke@digicert.com. They responded almost immediately and directed me to Cloudflare's abuse report form, where I was met with a wall. Now I'm back to Digicert asking them to please revoke them. Note that this isn't an urgent security situation, as the domain in question isn't in use currently. It's more of an annoyance, since the certs are valid for 1 year. Certificates in question: https://crt.sh/?id=11447235791 https://crt.sh/?id=11447235791 https://crt.sh/?id=11447092451 https://crt.sh/?id=11447092451
- aaomidi 2y agoThis is actually very interesting. Please let me know what digicert says once you say your request again. If they push back on this I’ll escalate it with your permission.
- aaomidi 2y agoI see the still haven’t revoked your cert. Has digicert started the revocation process?
- hurutparittya 2y agoI tried replying to the existing email thread which did not get a response. Tomorrow I'll attempt starting a new case, with a more clearly worded request. I'll let you know how that goes.
- hurutparittya 2y agoGreat success. This time it went without any issues and got the certificates revoked within 6 hours of my first email.
- aaomidi 2y agoAwesome!