If I purchase a domain name that has expired, do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site? In other words, do CAs check domain name expiration dates when issuing a certificate to ensure the certificate does not outlast ownership of the domain? Or, alternatively, do CAs monitor domain name ownership and revoke certificates for domains that have been dropped?
-
2That's a very good question, I'd never considered it before. Time to do some research! (Actually, screw that, time for bed. Will research in the morning!)– PolynomialJul 23, 2012 at 21:25
-
2Just remembered, this is quite similar to this question.– BrunoJul 23, 2012 at 21:34
-
After thinking about this, it seems the browser is better positioned to address this issue. It could compare the registration date for the domain from the whois record with the certificate issuing date, and only accept if the certificate date is later in time.– PulpSpyJul 24, 2012 at 14:02
-
@PulpSpy, not sure why a browser should reject a cert that's valid now and for which the domain name is valid now, on the basis that the a domain is going to expire in 10 months and the cert in 11 (more so because the domain could change hands before that anyway). The whois record will always be valid at the time the cert needs to be valid too for an SSL connection (for DNS purposes at the time).– BrunoJul 24, 2012 at 14:11
-
1Related: What are some risks of purchasing a “used” domain name– makerofthings7Jan 14, 2013 at 0:55
|
Show 3 more comments
3 Answers
Do I have any assurance that the previous owner does not have a valid HTTPS certificate for the site?
No, you don't.
CAs can issue certificate that are valid after the expiry date of the domain (at the time of issuance). Even if they didn't, a domain could be transferred before its expiry date.
In addition, you can't possibly control all the CAs that exist and that are trusted by potential clients. Even if there was a scheme that may monitor domain registration updates, not all CAs might be part of that scheme. You can't possibly know exactly all the CAs that your potential users may trust.
I can create my own CA and issue a certificate valid for the next 20 years for a domain that doesn't even exist yet. Of course, that's an extreme and pointless example, but if I use it as an internal CA and you happen later to register that domain, you'd have no way to know about it.
You could of course restrict your assumption to the major CAs around. However, as far as I know, they don't monitor changes to the whois database, at least for domain-validated certificates (I'm not sure if there's any provision for this situation with EV certs).
-
"I can create my own CA and issue a certificate valid for the next 20 years for a domain that doesn't even exist yet." This CA should not pass the test to enter the browser root certificate list! (but I am afraid it might) Jul 23, 2012 at 23:17
-
@curiousguy, you're absolutely right, it shouldn't. It's true few people would import CA certs explicitly. However, some browsers come with fairly large lists and some CAs sell intermediate CAs to companies. 100% reliability is quite unlikely there. I'm not saying the PKI system is "completely broken" in that respect, but it has a number of imperfections. (It's not clear when you read some CAs commercial texts that they know what they're talking about either...)– BrunoJul 24, 2012 at 1:01
-
Thanks Bruno. My question is more about the last paragraph of your answer: is it common practice for a CA to consider/monitor domain expiration? Do browsers consider this issue in their root certificate policies?– PulpSpyJul 24, 2012 at 13:46
-
@PulpSpy, not sure, I've never let a domain expire, but I've never received any reminder from a CA telling me that my domain was going to expire. It might depend on the CA. The problem is that the whole system is driven by its weakest link.– BrunoJul 24, 2012 at 14:08
If we take as example Verisign's Certification Practice Statement, there does not seem to be any control on the domain ownership end date (see the conditions on domain validation, page 83 and 84: nothing about dates). Actually, the same CPS states that they consider a domain validation to be good for up to 13 months (see page 76), and the maximum lifetime for an EV certificate is 27 months, so the best guarantee you can expect is that no certificate for a domain name will exceeds the end of ownership of the domain by more than 40 months. Which is a bit long.
And we talk here only about Verisign's EV certificates. Each CA has its own rules and there does not appear to be any consensus or strongly enforced limits on that matter. Ultimately, it is the responsibility of the OS/browser vendor to set boundaries, but, as far as I know, Microsoft/Mozilla/Apple do not have regulations for matching certificate validity periods to domain expiration.
answered Jan 13, 2013 at 23:04
You may be able to mitigate this risk by implementing TLSA (also known as DANE), where you essentially store your web servers public key in DNS. This is currently supported in Chrome.
I'm unsure if the prior owner's certificate takes precedent over DANE, or vice versa. Considering the security issue that it addresses, it would make sense that all TLS browsers attempt to DANE verify the connection (preferably over DNSSec) than traditional HTTPS
answered Jan 14, 2013 at 2:24
