After having the [email protected] email compromised, we found that someone issued a
Domain Validated SSL certificate for our domain. Now we want to have all such certificates revoked.
Is there a way to find all certificates issued to our domain by different SSL providers?

  • 1
    Try connecting to your site from different access points and/or through proxies, and contact CAs.
    – user49075
    Commented Jul 29, 2014 at 9:55
  • 1
    Change the password for the email address, check for emails about requesting a certificate and contact the CA to revoke the certificate.
    – BadSkillz
    Commented Jul 29, 2014 at 9:56
  • There are no emails on that mailbox (they have been deleted) Commented Jul 29, 2014 at 10:24
  • I don't think there is much more you can do besides call every CA and ask if they issued a certificate for your domain. There are tool that can discover SSL certificates (SSL Discovery) but these need an ip range to scan. Also keep an eye out for (new) DNS entries.
    – BadSkillz
    Commented Jul 29, 2014 at 12:07

2 Answers 2


There is no global directory of all issued certificates (X.509 was designed to support the Directory, but it never existed in practice). You will have to contact "all CA" and ask them nicely. Basically, this would mean going to their site, and using the "I lost my password" feature so as to regain control of your account, if it exists. Details vary depending on the CA.

Strictly speaking, the number of possible CA is not bounded. You may start with the root CA used by usual OS or browser, but each of these CA may have issued certificates for sub-CA who maintain their own list of customers. For instance, my own domain certificate was issued by my registrar, who himself is an intermediate CA who got his certificate from another root CA. Therefore, you cannot be certain that you detected and revoked all certificates issued in your name.

There are some mitigating circumstances, though:

  • To get the fake certificates, the attacker must have paid for them. This might have involved stolen credit card numbers, but when the payment bounces, the CA will notice it ("where's my money ?") and may automatically revoke the offending certificates. On the other hand, if the credit card was genuine, then it may point at the attacker.

  • Similarly, since the attacker had to pay in some way, then he probably concentrated on a couple of CA, not a hundred.

  • Certificates expire after one or two years (because CA want their customers to be recurring customers). So everything will be back to order by 2016.

  • Many OS or browsers don't check for revocation anyway. Thus, revoking certificates is nice but does not really solves things.

  • 1
    "To get the fake certificates, the attacker must have paid for them", unless the attacker used StartSSL.
    – user49075
    Commented Jul 29, 2014 at 19:33
  • 1
    "Certificates expire after one or two years" - recently I've been issued a 4-year Domain Validated certificate Commented Aug 21, 2014 at 23:34
  • Note it is possible to get a certificate for free from startssl.com
    – Ángel
    Commented Aug 24, 2014 at 18:57
  • 1
    There is a directory that aims to be global at least: Certificate transparency
    – user10008
    Commented Aug 25, 2014 at 5:04

Partly solving the underlying problem, you may use Public-Key-Pins header to restrict which certificates are valid for your domain (so a stolen certificate could only be used by a man-in-the-middle if used on the first connection to your site).

You can also use Public-Key-Pins-Report-Only to get notifications for failed Pin validation.

Both headers are defined in draft-ietf-websec-key-pinning.

I'm afraid that for actually figuring if the attacker requested more certificates, you would indeed have to ask all CAs (it would make for a great blog post if you really go this route, though).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .