Timeline for Would a signed TLS certificate prevent an attacker from stealing a domain?
Current License: CC BY-SA 4.0
3 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 21, 2023 at 21:38 | comment | added | vidarlo |
It depends. Using CAA records can make it more difficult, but ultimately Domain Validation doesn't check if you're affiliated with example.com when you apply for a certificate for subdomain.example.com. They validate that you have control over subdomain.example.com.
|
|
| Jan 21, 2023 at 21:22 | comment | added | slevin |
Thanks, so the point is the attacker will have to solve the certificate problem somehow. If the company otherwise follows good practices with their certificates, should they be able to prevent an attacker from obtaining a cert for sub.mycompany.com because the attacker can't prove they are associated with mycompany.com?
|
|
| Jan 21, 2023 at 20:53 | history | answered | vidarlo | CC BY-SA 4.0 |