Let's say I have a domain name, like mysupercoolproduct.com. I buy a 2 year SSL certificate for it, and then I am negligent and the domain gets snatched up by someone else. I still have a valid SSL Certificate for the domain, but I don't own the domain any more. (This could also occur if I sold the domain to someone)

What mechanisms are in place to invalidate a valid signed but illegitimately possessed SSL certificate? Since my pretend SSL cert was signed by a legitimate CA, browsers don't have a reason not to trust it. This would allow me to pull off the MITM attack of the century until it expires.

Are there any ways to globally invalidate all SSL certificates for a domain, if the domain expires or is sold to another company?

  • 1
    No, but certificate-transparency.org seems to be taking hold which will let you find the certs, and if you notify the CA that the subject no longer controls the domain they should test that and then revoke the cert. If you sell a domain, but don't turn over or at least retire the cert for it, I'd say you've defrauded the buyer and can be sued, but that's probably offtopic for SE. – dave_thompson_085 May 27 '16 at 0:50
  • @dave_thompson_085 Thanks for the link, and you're absolutely right; someone could sue your pants off for this! – DarthCaniac May 27 '16 at 13:50
  • doesn't the certificate have some information about the server, such as the ip address to validate the ssl when it was acquired? To pull of a MITM wouldn't you need to change the IP address, thereby invalidating the genuiine ssl? – Terry Kernan May 30 '16 at 10:13
  • @TerryKernan No, standard SSL certificates don't care about the IP address. You don't even need to MITM- you could do a DNS Spoof and use the malicious certificate as well. – DarthCaniac May 31 '16 at 20:35
  • If you sell a domain, but don't turn over or at least retire the cert for it, I'd say you've defrauded the buyer and can be sued - what it the domain simply is let to expire and somebody else ends up buying it when it becomes available? – thomasrutter Jun 29 '16 at 0:36

PKI Infrastructure provides the means to do this via revocation lists. If you purchase a domain from someone else, or snatch one up that has lapsed, part of that responsibility lies with the purchasing party. They should do their due diligence and contact the CA issuing authority to invalidate any other certificates that are out there. I'm sure there is some sort of proof required by the CA before they just randomly invalidate a Domain's certificate, but I've never done it before. Between OCSP and standard revocation lists, this shouldn't be a hard problem to overcome if your web/sys admins are doing their jobs right.

  • So I could theoretically register a popular but expired DN like coca-cola.com and ask revocation of all SSL certificates. When they discover the issue a few hours later they have to renew all their SSL certificates? Or can you "unrevoke" certificates :)? – Silver Jan 24 '17 at 13:47
  • In practice CAs are very slow to revoke, even though they're subject to rules which say they must revoke in under 24 hours, we simply don't stamp on them for breaking those rules. So probably they would reach out to Coca-Cola, and someone at Coca-Cola would get new certs, and then they'd revoke the old ones, perhaps as much as several weeks after you pointed it out. You could try making a fuss (the group mozilla.dev.security.policy would be the place to do that for the general public as Mozilla effectively operates this on behalf of the entire Web PKI) but that's likely to backfire. – tialaramex Sep 3 '17 at 8:28

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.