7

Let's say I have a domain name, like mysupercoolproduct.com. I buy a 2 year SSL certificate for it, and then I am negligent and the domain gets snatched up by someone else. I still have a valid SSL Certificate for the domain, but I don't own the domain any more. (This could also occur if I sold the domain to someone)

What mechanisms are in place to invalidate a valid signed but illegitimately possessed SSL certificate? Since my pretend SSL cert was signed by a legitimate CA, browsers don't have a reason not to trust it. This would allow me to pull off the MITM attack of the century until it expires.

Are there any ways to globally invalidate all SSL certificates for a domain, if the domain expires or is sold to another company?

Improve this question
6
  • 1
    No, but certificate-transparency.org seems to be taking hold which will let you find the certs, and if you notify the CA that the subject no longer controls the domain they should test that and then revoke the cert. If you sell a domain, but don't turn over or at least retire the cert for it, I'd say you've defrauded the buyer and can be sued, but that's probably offtopic for SE.
    – dave_thompson_085
    May 27, 2016 at 0:50
  • @dave_thompson_085 Thanks for the link, and you're absolutely right; someone could sue your pants off for this!
    – DarthCaniac
    May 27, 2016 at 13:50
  • doesn't the certificate have some information about the server, such as the ip address to validate the ssl when it was acquired? To pull of a MITM wouldn't you need to change the IP address, thereby invalidating the genuiine ssl?
    – Terry Kernan
    May 30, 2016 at 10:13
  • @TerryKernan No, standard SSL certificates don't care about the IP address. You don't even need to MITM- you could do a DNS Spoof and use the malicious certificate as well.
    – DarthCaniac
    May 31, 2016 at 20:35
  • If you sell a domain, but don't turn over or at least retire the cert for it, I'd say you've defrauded the buyer and can be sued - what it the domain simply is let to expire and somebody else ends up buying it when it becomes available?
    – thomasrutter
    Jun 29, 2016 at 0:36

1 Answer 1

Reset to default
2

PKI Infrastructure provides the means to do this via revocation lists. If you purchase a domain from someone else, or snatch one up that has lapsed, part of that responsibility lies with the purchasing party. They should do their due diligence and contact the CA issuing authority to invalidate any other certificates that are out there. I'm sure there is some sort of proof required by the CA before they just randomly invalidate a Domain's certificate, but I've never done it before. Between OCSP and standard revocation lists, this shouldn't be a hard problem to overcome if your web/sys admins are doing their jobs right.

Improve this answer
2
  • So I could theoretically register a popular but expired DN like coca-cola.com and ask revocation of all SSL certificates. When they discover the issue a few hours later they have to renew all their SSL certificates? Or can you "unrevoke" certificates :)?
    – Silver
    Jan 24, 2017 at 13:47
  • In practice CAs are very slow to revoke, even though they're subject to rules which say they must revoke in under 24 hours, we simply don't stamp on them for breaking those rules. So probably they would reach out to Coca-Cola, and someone at Coca-Cola would get new certs, and then they'd revoke the old ones, perhaps as much as several weeks after you pointed it out. You could try making a fuss (the group mozilla.dev.security.policy would be the place to do that for the general public as Mozilla effectively operates this on behalf of the entire Web PKI) but that's likely to backfire.
    – tialaramex
    Sep 3, 2017 at 8:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .