4 ms·

How can they automatically provision a certificate? Do they run or partner with a CA that doesn't require validation by the actual domain owner? Edit: If so, t

• eastdakota 12y ago
  Yes, we partnered with multiple CAs that are trusted by virtually every browser.
  • spacefight 12y ago
    Isn't provisioning certs without at least a simple human interaction from the domain holder against CA rules?
    • rjaco31 12y ago
      Well having a website hosted on Cloudflare implies that you had more interaction than most CAs will ever ask you to get a certificate, that is beside giving them the money.
    • iancarroll 12y ago
      No, I don't think that exists at least in the CA/B Baseline. You have to have consent, obviously, but that's obtained when you sign up for CloudFlare.
      • spacefight 12y ago
        Consent yes, though I can't fully parse "procedures established by". What procedures are meant here? https://cabforum.org/wp-content/uploads/Baseline_Requirements_V1_1_9.pdf https://cabforum.org/wp-content/uploads/Baseline_Requirement... "The CA MUST ensure that the certificate is issued with the consent of, and according to procedures established by, the owner of each Domain Name" EDIT: Here are the established authorization procedures: "11.1.1 Authorization by Domain Name Registrant For each Fully-Qualified Domain Name listed in a Certificate, the CA SHALL confirm that, as of the date the Certificate was issued, the Applicant (or the Applicant’s Parent Company, Subsidiary Company, or Affiliate, collectively referred to as “Applicant” for the purposes of this section) either is the Domain Name Registrant or hascontrol over the FQDN by: 1. Confirming the Applicant as the Domain Name Registrant directly with the Domain Name Registrar; 2. Communicating directly with the Domain Name Registrant using an address, email, or telephone number provided by the Domain Name Registrar; 3. Communicating directly with the Domain Name Registrant using the contact information listed in the WHOIS record’s “registrant”, “technical”, or “administrative” field; 4. Communicating with the Domain’s administrator using an email address created by pre-pending ‘admin’, ‘administrator’, ‘webmaster’, ‘hostmaster’, or ‘postmaster’ inthe local part, followed by the at-sign (“@”), followed by the Domain Name, which may be formed by pruning zero or more components from the requested FQDN; 5. Relying upon a Domain Authorization Document; 6. Having the Applicant demonstrate practical control over the FQDN by making an agreed-upon change to information found on an online Web page identified by a uniform resource identifier containing the FQDN; or 7. Using any other method of confirmation, provided that the CA maintains documented evidence that the method of confirmation establishes that the Applicant is the Domain Name Registrant or has control over the FQDN to at least the same level of assurance as those methods previously described. " IANAL and I'm sure that CF has had this double checked, but I still think it's a bold move to issue certs on their own account.
        • deleted 12y ago
          [deleted]
        • iancarroll 12y ago
          > Having the Applicant demonstrate practical control over the FQDN by making an agreed-upon change to information found on an online Web page identified by a uniform resource identifier containing the FQDN CloudFlare arguably has the consent of the domain holder (gray area but probably in CF's favor) and can pass the required validation. I do partially agree that the domain holder (CloudFlare's customer) should have been sent an opt-in email, but I think the positives outweigh the negatives.
          • nacs 12y ago
            For Cloudflare to work, they require that you use their DNS servers on the domain so that provides good validation.
• nknighthb 12y ago
  Domain validation has been available from multiple CAs by placing a root-level file on your webserver for years. If your domain points to a server controlled by a third party, they have always been able to pass domain validation.
  • 0x0 12y ago
    Does cloudflare require A records or NS records to point to them before issuing the cert? I guess maybe that could work. I'm still a little skeptical about the whole no-interaction-required part. Is there no way this is open to abuse? Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? Maybe it's no different than regular automatic domain validation though. Hopefully the backend that requests and retrieves new SSL certificates from the CA cannot be compromised.
    • innocenat 12y ago
      > Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.
      • 0x0 12y ago
        I guess you're right about that, but it still feels a bit weird that a third party can just allocate a private key and a valid certificate without the actual owner of the domain requesting it.
        • iancarroll 12y ago
          CloudFlare just simplifies this process. You can do the same thing if you can upload a file to a site.
          • spacefight 12y ago
            It's not the simplification - it's that they do it for all their clients at once - no opt-in.