1

Suppose I own the whynot.com domain. Can I request a certificate for google.com\0x.whynot.com ?

Improve this question

1 Answer 1

Reset to default
3

Since google.com\0x.whynot.com is not a valid hostname you should not by able to get a certificate for it. But it was possible once to misuse null characters like you attempt. For more details see Black Hat 2009: Breaking SSL With Null Characters.

Improve this answer
2
  • Thank you. It's not possible because how the SSL name encoding or browser's way of interpreting strings was changed or because CA's validate the name more accurately ? from the linked page "The CA ignores the subdomain"
    – cyzczy
    Apr 7, 2017 at 8:45
  • 2
    @adam86: both the validation in the browsers and the CA's was enhanced to make sure to accept only valid names.
    – Steffen Ullrich
    Apr 7, 2017 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .