SSL vendor practices

changlinn

Hi Everyone, Not going to name names, but I have recently witnessed a client who has registered a few SSL certs to subdomains for a domain they do not own. I thought this was against the practice of registrars, can someone point me to any code of conduct on this kind of thing.

Seems very dodgy if this high level registrar is allowing this what else are they allowing, what is the point of SSL if they are going to do this. Should I report it to their internal support, or is there someone higher I can go to?

docrice

Which CA did they register with?

changlinn

Can't really name names, but a big one. They aren't my employer and I have no relationship with them, I just prefer if it is confirmed against a code of conduct to disclose it to them first to have a chance to fix it.

docrice

For general certificate signing requests, the administrative contact of the domain is contacted as a "verification step" to ensure that only the authorized agents can request a certificate. This is done via e-mail. It sounds lame (and it is) but in most cases that's how it's done. If you go with higher cert "levels" (such as "extended validation") there's supposed to be more thorough checking to ensure the identity of the organization and the requester is indeed who they claim to be.

I would think it's generally against policy for anyone to try and get issued a cert for a domain they're not responsible for, much like trying to apply for a driver's license using a fake name.

Zartanasaurus

I've heard GoDaddy is pretty bad about this sort of thing.

jibbajabba

I registered a few SSLs myself and while Verisign and Thawte were painfully detailed when it came to confirm mine and the companies details, some others (actually forgot the name) simply supplied the cert after paying for it.

Having said all that - what's the point / worry ? If you do have a certificate, you need to install it on the loadbalancer / firewall / webserver. So even if someone buys a certificate of a domain (or subdomain) he doesn't own, there isn't much he can do unless he has access to the infrastructure, and installing it on another domain would cause cert errors which I am sure is as useful as self signed certs.

Or am I missing something obvious ?

docrice

All that would be left for an attacker to pull off a seamless attack would be a MITM via DNS, etc., which really isn't that hard in many public environments.