8

I have seen multiple questions focusing on multiple certificates for a single domain (e.g.: a.com/example and a.com/example_one).

However, what stops an individual from purchasing a certificate and certifying a site they do not own?

For example: site xxx.com has a certificate issued to them from a root CA. What stops me from registering that site xxx.com, with another CA?

2
  • Related (and possibly duplicate): security.stackexchange.com/questions/98038/…
    – Nzall
    Sep 13, 2015 at 21:47
  • 3
    Looks to me like a.com/example and a.com/example_one are the same doamin with different paths. Hence the certificate would be for a.com and not a.com/example and a.com/example_one.
    – jwilleke
    Sep 13, 2015 at 23:42

2 Answers 2

11

what stops an individual from purchasing a certificate and certifying a site they do not own?

Common methods of ownership validation are:

  • adding an DNS record
  • uploading a file to your web
  • sending and email to person in WHOIS
  • adding a meta tag to first page

What stops me from registering that site xxx.com, with another CA?

Nothing. You are allowed to have multiple certificates for one domain from multiple CAs.

4
  • Surley if the site had multiple Certificates then this would be a risk ?
    – KingJohnno
    Sep 13, 2015 at 16:31
  • 2
    @KingJohnno - as long as all of the certs are actually held by the site owner, what's the risk? Sep 13, 2015 at 16:59
  • You have more private keys (most often), so you have to secure more keys at the time.
    – Vilican
    Sep 13, 2015 at 17:03
  • You could add an extra validation step to your domain names by explicitly allowlisting the CA's which may give out certificates for your domain, using the CAA DNS Record. If an attacker would be able to bypass the ownership validation for one CA, your domain is only vulnerable if you have allowlisted them. This does not help against any CA going rogue, as they can just ignore the record.
    – Wouter
    Aug 7 at 14:09
6

For most CA's, they require the purchaser to verify ownership of the domain in one way or another.

There are two common methods:

  1. Sending an email to the email address indicated in the WHOIS records.
  2. Requiring that a random DNS TXT record be created.
5
  • Seems logical to me: presumably, the same CA wouldn't supply to different certificates to the same domain ? (the DNS TXT record would be there).
    – KingJohnno
    Sep 13, 2015 at 16:11
  • 6
    @KingJohnno I don't see why a CA won't issue multiple certificates for the same domain assuming the authenticity of the requester is verified.
    – user10211
    Sep 13, 2015 at 16:14
  • An SSL issuer will regularly issue new certificates for the same domain. Usually when you re-key the certificate. Sep 14, 2015 at 6:12
  • I know that at StartSSL you can't have multiple certificates with the same primary (sub)domain, but you can have one (sub)domain in as many valid certificates as you want. Also when you validated that you own the domain, you can create certificates for all the subdomains and just have to revalidate after 30 days. Other CAs also only check the ownership before creating the cert, so the DNS TXT record can be deleted afterwards!
    – Josef
    Sep 14, 2015 at 6:52
  • 2
    StartSSL supports multiple certs for one subdomain. However, not at free level.
    – Vilican
    Sep 14, 2015 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.