3 ms·
From the bugzilla "The actual reason for the underscore is so that services which allow users to create DNS records at subdomains (e.g. dynamic DNS services) c
by DarkmSparks 2y ago
From the bugzilla
"The actual reason for the underscore is so that services which allow users to create DNS records at subdomains (e.g. dynamic DNS services) can block users from registering subdomains starting with an underscore and be safe from unwanted certificate issuance. It serves the same purpose that /.well-known does for Agreed-Upon Change To Website, and that admin/administrator/webmaster/hostmaster/postmaster do for Constructed Email to Domain Contact. By using DNS records without underscores, DigiCert has violated a security-critical assumption that these services have made.
Therefore, this is truly a security-critical incident, "
That is a pretty brutal f' up of epic proportions... not sure any digicert cert should be trusted after that.
- mtlynch 2y agoDirect link to the comment: https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c10 https://bugzilla.mozilla.org/show_bug.cgi?id=1910322#c10 The author of that comment is Andrew Ayer, who also does great writeups about CA incidents and processes on his blog: https://www.agwa.name/blog/index https://www.agwa.name/blog/index
- kevincox 2y agoMy bigger concern is that what percentage of people will realize when delegating subdomains that having a leading underscore is a security vulnerability?