3 ms·
> Yeah... have they proven that this wasn't exploited? Presumably it would be fairly easy to test, for the vast majority of cases. HTTP file validation is all
by michaelt 2y ago
> Yeah... have they proven that this wasn't exploited?
Presumably it would be fairly easy to test, for the vast majority of cases.
HTTP file validation is allowed for DV certificates, so you can test a domain by connecting to it. Testing from a variety of locations around the world avoids the risk of MITM. If you issued a certificate for example.com and it's now being used by example.com, doesn't that prove the same thing?
But whether it's been exploited is, in a sense, irrelevant. The baseline requirements don't say "when you detect a mis-issued cert carry out more checks and decide for yourself whether to revoke" - they say the CA must revoke.
- 8organicbits 2y agoOh sure, they need to revoke yesterday, but if a certificate was mis-issued there's downstream security impact that needs to be handled immediately. > HTTP file validation is allowed for DV certificates, so you can test a domain by connecting to it. This was validation over DNS using a CNAME record. You don't need to keep the verification records around after the certificate is issued, so post-hoc analysis won't tell you much. But worse, how does the CA know if a RANDOM.example.com CNAME record was created by a customer vs the domain owner? The underscore is supposed to solve that, and they didn't use it.