Update: It seems like a Finnish man was able to demonstrate this "attack" by issuing a certificate for the domain
live.fi by having the address
Last year, I made a bet with a friend that I can get a browser-trusted certificate with his domain name in order to launch a successful MiTM attack on his login form to steal his password. Long story short: I lost the bet; I wasn't able to convince any of the 16 CAs I contacted that I'm the legitimate owner of the domain. Even though I had an email account on his mail server and had FTP access to a user directory under the WWW directory.
Let's go back a little. What do CAs do before issuing you a basic certificate? They have a process called Domain Control Validation (DCV). The good news is that DCV makes it difficult for somebody to issue a certificate on your behalf. The bad news is that each CA can make custom amendments and modifications to the DCV, which makes it impossible to tell which CA will be the weakest link.
Generally speaking, CAs use one of the following methods:
1. Domain Email Validation: They will send you a verification link/code to one of the following email addresses:
- Whatever email you have in the WHOIS records (if you have WHOIS privacy, they'll ask you to contact your registerer and setup email forwarding).
2. Domain CNAME Validation: They will ask you to create a custom CNAME entry. It usually involves hashes of your Certificate Signing Request (CSR) or a randomly-generated key of their choice. An example of such entry is
<MD5(CSR)>.yourdomain.com. CNAME <SHA1(CSR)>.CA.com
3. HTTP Request Validation: They will ask you to upload a specific text file to the root of your domain. The file should be accessible with the following HTTP request
And it should contain
Interesting findings: During my "challenge", I managed to get one CA (SSL.COM) to agree on uploading the text file to
Domain/MyUserName/Something.txt and email me the verification link to
MyUserName@Domain. However, they insisted that they must verify me with a phone call to the number in the WHOIS records. I also found out that some CAs require a phone as a first-step verification, even before the email verification. Such CAs don't issue certificates for domain names using privacy options.
So, to directly answer your question, prevent your users from creating special email addresses (mentioned above. You also might want to add
hostadmin@, etc; prevent your users from creating CNAME entries; and, finally, prevent them from adding files to the root of your domain.
Note: Just because 16 CAs turned out to be good, it doesn't mean that there aren't ones out there that are willing to compromise in the name of "customer convience".