1

There are many SSL certificate resellers - some are well known enterprises with good reputation (e.g. domain name registrars) while others are small and unknown companies.

It is clear that resellers don't have access to private keys of certificates purchased via them (unless private key is given to or taken from the reseller; CSR does not contain private key).

But the tricky part is validation procedures done on reissuance (issuance of similar certificate with different private key, during validity period of the the certificate).

  1. My experience shows that at least in some reseller-CA combinations old certificates are not automatically/immediately revoked when doing reissuance. This leads to situation where several certificates (with different private keys) for the same domain name are valid during the same validity period, bought via the same certificate purchase. There are also some legitimate use cases for this (e.g. if multiple servers serving the same site are secured with the "same" certificate and each server has its own private key). Are there CAs that automatically revoke old certificates during reissuance?
  2. My experience shows that at least in some reseller-CA combinations (at least domain level) re-validation is always done during reissuance. Is there any regulations for CAs enforcing re-validation on every reissuance? Is there a risk that malicious reseller could deceive CA and request a certificate reissuance without the re-validation procedure (i.e. can malicious reseller generate his own CSR, give it to CA/RA and get it signed, claiming his customer is doing reissuance)? If yes, are there CAs whose policies require re-validation on every reissuance?

Basically the question is - is it secure to buy SSL certificates from cheap (and unknown) resellers? Or they can abuse the reissuance process (by fooling CAs/RAs to issue fraudulent certificates)?

Improve this question
5
  • 1
    This seems a lot like a shopping recommendation question
    – Rory Alsop ♦
    Dec 25, 2014 at 0:07
  • The question is about regulations and policies of CAs. I suppose answers to this question would be helpful for Stack Exchange users. If you insist, I can remove parts about asking specific CAs or leave only question about regulations requiring CAs to do re-validation on every reissuance. I think that such shortening of the question would cut-out the fact that several certificates with different keys may co-exist (there may be some Stack Exchange users not aware of this).
    – DavisNT
    Dec 25, 2014 at 0:15
  • You said "at least in some reseller-CA combinations old certificates are not automatically/immediately revoked when doing reissuance". I'm genuinely intruiged. Could you link one CA where automatic (unsolicited) revocation is in the policy?
    – StackzOfZtuff
    Dec 25, 2014 at 2:51
  • @StackzOfZtuff I do not know any CAs where automatic revocation (of old certificates during reissuance) is in policy. Although I have done very few reissuances.
    – DavisNT
    Dec 25, 2014 at 14:08
  • @StackzOfZtuff I remember one of my CAs (Namecheap the domain registrar/certificate reseller) automatically revoking for a few days in the aftermath of Heartbleed. :-D
    – Matt Nordhoff
    Dec 28, 2014 at 6:06

2 Answers 2

Reset to default
3

It's not any less secure than going directly through a CA. CA's can be compromised just like anyone else. Even if the CA required revalidation, the reseller could just claim to have done it.

Improve this answer
2

Typically it's as safe to buy certificates through resellers as it is to buy directly from the CA through whom the reseller is operating. In the end, the relationship is defined by the CA, and the reseller operates within the bounds defined by that CA; if any insecurities exist due to this relationship, then it's the responsibility of the CA to remedy them.

Improve this answer
3
  • Are there any industry standards/regulations or CA policies that require CAs/RAs to always do (at least domain control) validation of end-user upon reissuance? Or there might be cases when malicious resellers abuse reissuance process and get fraudulent CSRs signed without CA/RA contacting customer (end-user) directly?
    – DavisNT
    Dec 28, 2014 at 15:28
  • The model of the CA industry is based entirely on convincing the browsers to trust them. The browser companies come up with their own rules as they see fit.
    – tylerl
    Dec 28, 2014 at 17:12
  • The way you should be thinking of CA security is really a weakest link model. The weakest, least trustworthy CA that's included in mainstream browsers is the maximum security that ALL CAs are. They can all issue certificates for all domains AFAIK, so choosing a "secure" one yourself doesn't really add a whole lot. The CA system is essentially broken and needs a better model. But at the moment it's better than all the alternatives.
    – Steve Sether
    Jan 28, 2015 at 19:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .