8

I have seen multiple questions focusing on multiple certificates for a single domain (e.g.: a.com/example and a.com/example_one).

However, what stops an individual from purchasing a certificate and certifying a site they do not own?

For example: site xxx.com has a certificate issued to them from a root CA. What stops me from registering that site xxx.com, with another CA?

  • Related (and possibly duplicate): security.stackexchange.com/questions/98038/… – Nzall Sep 13 '15 at 21:47
  • 3
    Looks to me like a.com/example and a.com/example_one are the same doamin with different paths. Hence the certificate would be for a.com and not a.com/example and a.com/example_one. – jwilleke Sep 13 '15 at 23:42
10

what stops an individual from purchasing a certificate and certifying a site they do not own?

Common methods of ownership validation are:

  • adding an DNS record
  • uploading a file to your web
  • sending and email to person in WHOIS
  • adding a meta tag to first page

What stops me from registering that site xxx.com, with another CA?

Nothing. You are allowed to have multiple certificates for one domain from multiple CAs.

  • Surley if the site had multiple Certificates then this would be a risk ? – KingJohnno Sep 13 '15 at 16:31
  • 2
    @KingJohnno - as long as all of the certs are actually held by the site owner, what's the risk? – Neil Smithline Sep 13 '15 at 16:59
  • You have more private keys (most often), so you have to secure more keys at the time. – Vilican Sep 13 '15 at 17:03
6

For most CA's, they require the purchaser to verify ownership of the domain in one way or another.

There are two common methods:

  1. Sending an email to the email address indicated in the WHOIS records.
  2. Requiring that a random DNS TXT record be created.
  • Seems logical to me: presumably, the same CA wouldn't supply to different certificates to the same domain ? (the DNS TXT record would be there). – KingJohnno Sep 13 '15 at 16:11
  • 6
    @KingJohnno I don't see why a CA won't issue multiple certificates for the same domain assuming the authenticity of the requester is verified. – Ayrx Sep 13 '15 at 16:14
  • An SSL issuer will regularly issue new certificates for the same domain. Usually when you re-key the certificate. – Mark Henderson Sep 14 '15 at 6:12
  • I know that at StartSSL you can't have multiple certificates with the same primary (sub)domain, but you can have one (sub)domain in as many valid certificates as you want. Also when you validated that you own the domain, you can create certificates for all the subdomains and just have to revalidate after 30 days. Other CAs also only check the ownership before creating the cert, so the DNS TXT record can be deleted afterwards! – Josef Sep 14 '15 at 6:52
  • 2
    StartSSL supports multiple certs for one subdomain. However, not at free level. – Vilican Sep 14 '15 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.