4 ms·

It sure reads as they genereated 2mio+ certs - that's probably why they thank GlobalSign and Comodo in the blog post. I'm not sure how I should feel, if compan

It sure reads as they genereated 2mio+ certs - that's probably why they thank GlobalSign and Comodo in the blog post. I'm not sure how I should feel, if company x (where I am a registered but non-paying customer in their free tier) gets a cert in my name withouth asking before.

nknighthb 12y ago
A cert in your domain name. Something they could always do. As can anyone you've given control of your domain to. Domain validation is how most certificates are issued.
- spacefight 12y ago
  They could have done that by MITM the validation email you mean? EDIT: Ah, there are more options than email validation - my CA didn't offer those. Learned something, thanks.
  - nknighthb 12y ago
    No. Email is not the only supported method of domain validation. See, for example, Comodo's documentation: https://support.comodo.com/index.php?/Default/Knowledgebase/Article/View/791/16/alternative-methods-of-domain-control-validation-dcv https://support.comodo.com/index.php?/Default/Knowledgebase/...
  - deleted 12y ago
    [deleted]