4

I'm trying to understand the security part in SSL.

Lets say I have a domain called xyz.com and I was able to successfully verify with CA. But the domain expires 1 year from now.

However I was able to get a SSL that has validly for 3 Years.

I dropped the domain xyz.com but after sometime that domain got backordered by someone else.

Now I can still use my unexpired xyz.com SSL and trick the user that they are in xyz.com even though I don't have access to that domain.

Is such things possible? If such things happen, CA will be in trouble right? How do the CA prevent such things?

migrated from crypto.stackexchange.com Sep 3 '17 at 13:12

This question came from our site for software developers, mathematicians and others interested in cryptography.

5

Yes, the scenario you are describing is kind of a loophole in the CA system. It is the obligation of the client (the certificate owner) to inform the CA that the ownership of the domain has ended. The CA (usually) does not do any active checks after the issuance has happened.

There are steps taken, to mitigate this problem, tough:

  1. The Baseline requirements of the CA/Browser Forum do not allow certificates valid for more then 825 days starting next year, so the time where you could do attacks with your certificate will be shorter
  2. Certificate Transparency, which will be required from all certificates next year, too, will allow the new domain owner to easily check if your certificate is still valid.
  • 2
    Yes. I see it only as a minor loophole, compared to rogue and incompetent CAs. There has been many incidents like this, and doubtless many more that stayed under the radar. Competent services of TLAs for sure are able to get certificates that will pass the test of standard browsers. When something really needs to be secure, we can't fully trust the general worldwide CA system; it is not very secure (but still useful, like a lock). – fgrieu Sep 2 '17 at 18:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.