2 ms·
> The CA/Browser Forum Baseline Requirements (BRs) (which all CAs are required to adhere to, by virtue of their being included in various browser and OS trust s
by tzs 2y ago
> The CA/Browser Forum Baseline Requirements (BRs) (which all CAs are required to adhere to, by virtue of their being included in various browser and OS trust stores), say that revocation is required within 24 hours when “[t]he CA obtains evidence that the validation of domain authorization or control for any Fully‐Qualified Domain Name or IP address in the Certificate should not be relied upon” (section 4.9.1.1, point 5).
Does that revocation requirement actually apply to these particular certificates?
If I've understood the problem it is that DigiCert was issuing challenge keys for DNS based validation that did not start with the required underscore.
The underscore is required to prevent an attack that only works against sites that allow users to create subdomains.
The particular sites of the plaintiff's clients are not such sites and so has the CA actually obtained "evidence that the validation [...] should not be relied upon"?
- 8organicbits 2y agoHow does the CA validate that the plaintiff's client's sites don't match that criteria? Should they take the plaintiff's lawyer's word for it? You can't really go off script with stuff like this, there's too many gotchas that you need to think through. I wonder if we could come up with a process where a customer could push another DNS record to redo the verification. They'd need to act fast to beat the 24 hour revocation window, but maybe that's better than a full re-issuance? Probably better to invest in re-issuance agility though.