Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When registering for an SSL cert, I was able to validate that I "owned" the domain I was creating the cert for by having a valid @domain.com email address. If I worked for a large company, say Microsoft or something, and have a valid me@microsoft.com email address, how am I prevented from being able to create a valid SSL cert for microsoft.com?

Maybe Microsoft has something in place to handle this, but what if the company is a bit smaller and doesn't have anything in place?

share|improve this question

marked as duplicate by Noordung, Adnan, Xander, Eric G, Gilles Mar 21 at 21:27

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
I can't believe an E-Mail address was enough. I was required to have the domain owner's phone number be entered to a public phone book to verify my identity. Funny enough, at that point I didn't even have a business phone number. I got a new mobile phone contract just for the purpose of this SSL cert. It wasn't even an EV cert! –  Prinzhorn Mar 21 at 11:23
    
I'm adamant I recall a reasonably high-profile occurance of something similar a few years ago - a webmail service, perhaps hotmail or the ilk. I can't find any reference to it from a cursory google, though. I seem to recall the attacker simply registered an 'admin-sounding' username - "postmaster@hotmail.com" or something - and simply got an SSL cert emailed to it. –  randomdude Mar 21 at 12:44
    
As an aside, just an email address is enough to get a client SSL certificate, but it will be for that specific address, not the domain. –  armb Mar 21 at 14:46
1  

2 Answers 2

up vote 22 down vote accepted

It's not just any email address at that domain. I have a valid gmail address, but that's not enough to convince Verisign that I own gmail.com.

Instead, at the very least, you need to control one of a specific set of addresses, including the email address listed in the whois record for the domain, and also often some of the following:

  • admin@example.com
  • administrator@example.com
  • hostmaster@example.com
  • root@example.com
  • webmaster@example.com
  • postmaster@example.com

In addition to that, depending on the domain in question and often triggered an by automatic flagging system, they may require additional manual validation by an employee of the CA. If you were to try to get a certificate for microsoft.com, for example, it probably wouldn't work even if you did control one of the email addresses listed above.

share|improve this answer
    
Interesting. The email I picked was admin@mydomain.com when I registered and thus wrongly concluded it could be any domain. –  Anthony Kraft Mar 21 at 3:06
1  
I believe they also use the Admin or Technical contact from your Whois / Domain registration information. I remember having to change my contact info when getting an SSL cert a long time ago. –  Mat Carlson Mar 21 at 11:13

The registration authority for a given certificate authority has rules that govern how they will verify the identity of a requester. Not all authorities have equal security or quality controls. The system relies upon the registration authority doing its proper due diligence, but if they are shoddy someone could get a cert issues who should not.


This is why the Extended Validation (EV) certificates were introduced. To obtain one of these certs requires a lot more background checking and due diligence giving the end user greater assurance its a legit cert. There are industry guidelines for issuing an EV cert.

For example:

9.2.1 Subject Organization Name Field

Certificate field:subject:organizationName (OID 2.5.4.10 )

Required/Optional:Required

Contents:This field MUST contain the Subject’s full legal organization name as listed in the official records of the Incorporating or Registration Agency in the Subject’s Jurisdiction of Incorporation or Registration or as otherwise verified by the CA as provided herein. A CA MAY abbreviate the organization prefixes or suffixes in the organization name, e.g., if the official record shows “Company Name Incorporated” the CA MAY include “Company Name, Inc.”

You may find this blog, Why are the Certification Authority/Browser Baseline Requirements so important?, on Symantec's site useful for this question.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.