We host sites for multiple companies and sites are hosted with custom domains. For Example

  • news.CompanyX.com
  • news.CompanyY.com

We have complete control on hosted site but do not have control over "CompanyX.com" or "CompanyY.com" and emails of these domains. These companies add CNAME DNS entries for sites that we host.

Tried to search little bit and as per this link https://support.comodo.com/index.php?/comodo/Knowledgebase/Article/View/791/0/

"We look for the file at every valid Authorization Domain, i.e. we start with the FQDN and then we will strip one or more labels from left to right in the FQDN and will look for the file on each intermediate domain."

They have said that they will strip labels and look for files on each intermediate domain. But we don't have access to web servers of "CompanyX.com" or "CompanyY.com".

Is there any way, we can complete DCV (for news.CompanyX.com single domain certificate) on our own without contacting CompanyX or CompanyY.

  • The details on how to do this might be specific to Comodo. Have you contacted their support? Why would you not want to contact the domain owners if you are setting up certificates for them? – schroeder Sep 1 '17 at 9:12
  • I can contact domain owners but those are big companies and it can take some time. Also my question is not specific to Comodo, I believe other authorities have similar rule. – Chintak Chhapia Sep 1 '17 at 9:36
up vote 1 down vote accepted

The preferred method of domain control validation is usually to receive the email address registered in the whois database. However, Comodo does provide a couple alternative validation methods:

Validation by alternative methods of DCV – There are currently 3 alternative methods you can pick from. The first two involve uploading a .txt file containing hashes of your CSR to your web server. The third involves adding the hash of your CSR as a DNS CNAME for your domain. In all cases, Comodo will run an automated test to ensure that you have completed the task.

Since you control neither the registered email address nor the DNS, the only validation mechanism that you can do is the one where you serve a certain text file on the domain. So yes, you can pass domain validation for the subdomain you have control of. Your domain control validation will only be considered valid for the subdomain you control.

  • Lie, thanks for your response, but as per documentation on Comodo "We look for the file at every valid Authorization Domain, i.e. we start with the FQDN and then we will strip one or more labels from left to right in the FQDN and will look for the file on each intermediate domain", so do we need to put file a each intermediate domain ? – Chintak Chhapia Sep 4 '17 at 17:13
  • 1
    For single domain certificate, you don't need to have the file on every level, just the FQDN that you are ordering for. The domain where they found the file will be considered the authorization domain. The assumption here is that if you control a subdomain, then you also control its sub-subdomain. – Lie Ryan Sep 5 '17 at 5:39

If you have no requirement to use a specific CA, take a look at Let's Encrypt. They are doing exactly what you want. They also provide a small script called Certbot, which automates the whole process.

Certbot works by placing the ACME challenge in a publicly accessible directory, allowing the CA to verify your control over the domain. This is basically the same as Comodo's HTTP server validation.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.