3 ms·

The bug sounds interesting. The underscore is needed to ensure the CNAME isn't a valid domain name. For services that offer subdomains for customers, an attacke

The bug sounds interesting. The underscore is needed to ensure the CNAME isn't a valid domain name. For services that offer subdomains for customers, an attacker could get a certificate for the parent domain. Like if example.com offered subdomains based on a name the user chooses, the attacker would start a certificate verification process and get a random value from Digicert. They'd then create an account with that random value, causing the example.com service to create a CNAME for <random>.example.com. Digicert then sees the random value and issues the certificate for example.com to the attacker. The underscore is there as _RANDOM.example.com isn't a valid domain name, so you'd expect services to reject these sorts of domains. Edit: > Therefore, this is truly a security-critical incident, as there is a real risk (not a negligible 2^-150 risk as implied by DigiCert) that this flaw could have been exploited to get unauthorized certificates. Revocation of the improperly validated certificates is security-critical. Yeah... have they proven that this wasn't exploited? With 83,000 certificates getting revoked this isn't a small scale mistake.

michaelt 2y ago
> Yeah... have they proven that this wasn't exploited? Presumably it would be fairly easy to test, for the vast majority of cases. HTTP file validation is allowed for DV certificates, so you can test a domain by connecting to it. Testing from a variety of locations around the world avoids the risk of MITM. If you issued a certificate for example.com and it's now being used by example.com, doesn't that prove the same thing? But whether it's been exploited is, in a sense, irrelevant. The baseline requirements don't say "when you detect a mis-issued cert carry out more checks and decide for yourself whether to revoke" - they say the CA must revoke.
- 8organicbits 2y ago
  Oh sure, they need to revoke yesterday, but if a certificate was mis-issued there's downstream security impact that needs to be handled immediately. > HTTP file validation is allowed for DV certificates, so you can test a domain by connecting to it. This was validation over DNS using a CNAME record. You don't need to keep the verification records around after the certificate is issued, so post-hoc analysis won't tell you much. But worse, how does the CA know if a RANDOM.example.com CNAME record was created by a customer vs the domain owner? The underscore is supposed to solve that, and they didn't use it.
8organicbits 2y ago
Someone has asked this question to DigiCert on the thread. Looking forward to a reply: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c15 https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c15

michaelt 2y ago

> Yeah... have they proven that this wasn't exploited? Presumably it would be fairly easy to test, for the vast majority of cases. HTTP file validation is allowed for DV certificates, so you can test a domain by connecting to it. Testing from a variety of locations around the world avoids the risk of MITM. If you issued a certificate for example.com and it's now being used by example.com, doesn't that prove the same thing? But whether it's been exploited is, in a sense, irrelevant. The baseline requirements don't say "when you detect a mis-issued cert carry out more checks and decide for yourself whether to revoke" - they say the CA must revoke.

8organicbits 2y ago
Oh sure, they need to revoke yesterday, but if a certificate was mis-issued there's downstream security impact that needs to be handled immediately. > HTTP file validation is allowed for DV certificates, so you can test a domain by connecting to it. This was validation over DNS using a CNAME record. You don't need to keep the verification records around after the certificate is issued, so post-hoc analysis won't tell you much. But worse, how does the CA know if a RANDOM.example.com CNAME record was created by a customer vs the domain owner? The underscore is supposed to solve that, and they didn't use it.

8organicbits 2y ago

Someone has asked this question to DigiCert on the thread. Looking forward to a reply: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c15 https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c15