0

A few days ago, I received the email below (supposedly) from DigiCert, about an SSL certificate. I am the owner of the domain (redacted to example.com) but I guess it's kind of trivial to look this up somewhere. The certificate is backed up by an intermediate certificate authority named "Trust Provider B.V. DV SSL CA - G2" and was bought from a company named Version, not Whitelabel. Frankly, I've never seen that name before. I've seen that Digicert acquired some website business from Symantec but that was half a year ago.

Is this a real e-mail or a phishing attempt?

Dear Domain Administrator,

We've received a Whitelabel certificate request for example.com. (With DigiCert's recent acquisition of Whitelabel, we're now responsible for processing your order.)

Order info:
Domain name: example.com
Order number: [redacted]
Ordered on: 5 Mar 2018
Certificate type: DV

What's next?

Before we can issue your certificate, approve the request to verify that you control example.com.

View the order details and complete the request here (link is valid for 30 days): https://dcv.digitalcertvalidation.com/link/domain-control-validation/?t=[redacted]

Contact us if you have questions or need to reject the request here: (801) 441-6086

Why am I getting this email from DigiCert?

Recently, DigiCert acquired Whitelabel and all of its SSL/TLS services. While there will continue to be changes to Whitelabel as we build a stronger website security platform, we can promise you that things will get better and that we will continue to dedicate ourselves to providing you with the best website security experience possible.

Thank you,
Whitelabel Customer Support
(801) 441-6086
Support ID: [redacted]

Improve this question
4
  • 2
    Symantec has a lot, and by a lot, I mean really a lot of CA subbrands, often with no apparent connections unless you know where to look. According to censys, the intermediate CA "Trust Provider B.V. DV SSL CA - G2" is an Intermediate CA that roots to GeoTrust root. GeoTrust was owned by Symantec and is now owned by Digicert when they acquired Symantec's certificate business.
    – Lie Ryan
    Commented Mar 10, 2018 at 17:07
  • 2
    Due to Symantec's unusual circumstances during the acquisition, Digicert was required to revalidate nearly all Symantec-issued certificates. I have seen some certificate resellers that automatically resubmits your CSR for revalidation without much communication, and the wording of Digicert's emails doesn't indicate that these request has been submitted by the reseller on your behalf either. If in doubt, contact your reseller to verify whether that request comes from them.
    – Lie Ryan
    Commented Mar 10, 2018 at 17:18
  • 1
    It should perhaps be emphasized that even though the acquisition happened several months ago, the revalidation is happening just about now.
    – tripleee
    Commented Mar 12, 2018 at 13:48
  • Check with the Chrome Console if your site will be affected by the upcoming Symantec distrust. Instructions on Scott Helme's blog: scotthelme.co.uk/are-you-ready-for-the-symantec-distrust -- If you are in fact affected, then I guess this might be legitimate.
    – StackzOfZtuff
    Commented Mar 12, 2018 at 14:33

2 Answers 2

Reset to default
4

The mail makes it clear that it is a reaction to a request to issue a certificate for your domain and that you need to verify that you are the owner of the domain by following the link if you want the certificate gets issued.

While the mail seems to tell a solid story it is impossible from the information you've provided to know if the mail is really from DigiCert and also if you should follow the instructions in the mail or not. The main information which is missing: Did you as the owner of the domain recently requested that a certificate should be issued for the domain or not? If you did not recently requested a requested a certificate to be issued then somebody might be trying to trick you into confirming something you did not want. If you instead actually requested the certificate and did not get it yet then this verification mail is probably valid.

If in doubt please contact the company you usually use to buy the certificates.

Improve this answer
1
  • Did you as the owner of the domain recently requested that a certificate should be issued for the domain or not? - not recently, no. The certificate was last renewed on May 25th, 2017. I'll contact the company, thanks.
    – Glorfindel
    Commented Mar 12, 2018 at 8:43
0

I started searching the RapidSSL website and found this article: https://knowledge.rapidssl.com/support/ssl-certificate-support/index?page=content&actp=CROSSLINK&id=INFO2608

Exactly a week after the first email from them, I received 5 new emails on the 5 email addresses as described in this article:

So that raised my confidence a bit.

On that same web page is a big button for a Live Chat. Within minutes I spoke to 2 representatives. I just gave them the order number from their first email and they were able to tell me my domain. That convinced my and I liked the URL in the first email. Immediately the representative confirmed my domain.

So if you don't trust it, use the RapidSSL Support.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .