Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

After having the hostmaster@domain.com email compromised, we found that someone issued a
Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked.
Is there a way to find all certificates issued to our domain by different SSL providers?

share|improve this question
1  
Try connecting to your site from different access points and/or through proxies, and contact CAs. –  Ricky Demer Jul 29 at 9:55
1  
Change the password for the email address, check for emails about requesting a certificate and contact the CA to revoke the certificate. –  BadSkillz Jul 29 at 9:56
    
There are no emails on that mailbox (they have been deleted) –  Karim Jul 29 at 10:24
    
I don't think there is much more you can do besides call every CA and ask if they issued a certificate for your domain. There are tool that can discover SSL certificates (SSL Discovery) but these need an ip range to scan. Also keep an eye out for (new) DNS entries. –  BadSkillz Jul 29 at 12:07

2 Answers 2

up vote 5 down vote accepted

There is no global directory of all issued certificates (X.509 was designed to support the Directory, but it never existed in practice). You will have to contact "all CA" and ask them nicely. Basically, this would mean going to their site, and using the "I lost my password" feature so as to regain control of your account, if it exists. Details vary depending on the CA.

Strictly speaking, the number of possible CA is not bounded. You may start with the root CA used by usual OS or browser, but each of these CA may have issued certificates for sub-CA who maintain their own list of customers. For instance, my own domain certificate was issued by my registrar, who himself is an intermediate CA who got his certificate from another root CA. Therefore, you cannot be certain that you detected and revoked all certificates issued in your name.

There are some mitigating circumstances, though:

  • To get the fake certificates, the attacker must have paid for them. This might have involved stolen credit card numbers, but when the payment bounces, the CA will notice it ("where's my money ?") and may automatically revoke the offending certificates. On the other hand, if the credit card was genuine, then it may point at the attacker.

  • Similarly, since the attacker had to pay in some way, then he probably concentrated on a couple of CA, not a hundred.

  • Certificates expire after one or two years (because CA want their customers to be recurring customers). So everything will be back to order by 2016.

  • Many OS or browsers don't check for revocation anyway. Thus, revoking certificates is nice but does not really solves things.

share|improve this answer
    
"To get the fake certificates, the attacker must have paid for them", unless the attacker used StartSSL. –  Ricky Demer Jul 29 at 19:33
    
"Certificates expire after one or two years" - recently I've been issued a 4-year Domain Validated certificate –  Karim Aug 21 at 23:34
    
Note it is possible to get a certificate for free from startssl.com –  Ángel Aug 24 at 18:57
    
There is a directory that aims to be global at least: Certificate transparency –  user10008 Aug 25 at 5:04

Partly solving the underlying problem, you may use Public-Key-Pins header to restrict which certificates are valid for your domain (so a stolen certificate could only be used by a man-in-the-middle if used on the first connection to your site).

You can also use Public-Key-Pins-Report-Only to get notifications for failed Pin validation.

Both headers are defined in draft-ietf-websec-key-pinning.

I'm afraid that for actually figuring if the attacker requested more certificates, you would indeed have to ask all CAs (it would make for a great blog post if you really go this route, though).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.