5

I bought a domain on Namecheap a few weeks back and now that I want to set it up, I visited my domain on the web and discovered that it had a valid cert issued and was pointing to an unknown site. The cert was issued by Let's Encrypt on Dec 1 2022.

Presumably Namecheap could validate the domain and get certificates issued without my knowledge, since the domain by default points to servers they control. Does this pose a major security issue? How can people ensure that no certificates are issued in the time between the domain getting purchased and DNS settings applied on the dashboard?

Improve this question
3
  • Since Namecheap is in bed with Comodo for certificate issuing purposes, I find it odd that they'd putatively set up a Let's Encrypt certificate. More information, such as the name of the domain and whether hosting was also purchased, would be useful.
    – gowenfawr
    Dec 26, 2022 at 13:35
  • Is "a few weeks back" before or after Dec 1?
    – Paŭlo Ebermann
    Dec 26, 2022 at 20:49
  • I bought the domain in early November and did nothing with it until a few days ago.
    – Ermir
    Dec 26, 2022 at 22:52

1 Answer 1

Reset to default
7

Can Namecheap get certificates issued for my domain

Yes. They control the nameservers, so they could change the records to allow issuing a certificate for your domain. And when not using their nameservers, they could quickly switch them for validation, too.

without my knowledge?

Maybe. It depends on the limits of your knowledge. The fine print of your contract might have included a provision that allows them to. You may have enabled a service that automatically includes a certificate. Perhaps it was even requested by a third party providing you a software, and not Namecheap itself.

As user mti2935 noted, the certificate will be logged in the Certificate Transparency logs, so you would (could) "know" it. For instance, you can check the certificates issued to your domain on https://crt.sh/

I would recommend you check to which server the domain is resolving to, as the entity that controls it is the one that will have requested the Let's Encrypt certificate that server is using.

Improve this answer
3
  • 4
    "... check to which server the domain is resolving to, as the entity that controls it is the one that will have requested the Let's Encrypt certificate that server is using." - Not necessarily; Let's Encrypt certificates can be issued after DNS validation, requiring only control over DNS records, not the destination host. That might be an attractive option for a DNS registrar.
    – marcelm
    Dec 26, 2022 at 18:11
  • 2
    @marcelm that server presented the LetsEncrypt certificate, so it has the private key.
    – Ángel
    Dec 26, 2022 at 19:30
  • I saw this question and went to check on a few domains I am currently using for email, and well, turns out that there were ssl certificates emitted for those domains. I am using porkbun and they have an offer of a "free ssl certificate" for all domains. My guess is that upon domain registration they are automatically generating these certs so they can provide it for their customers. I am not happy with the practice, however I don't believe it is malicious in intent.
    – Jean Pacher
    Jan 6 at 14:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .