1

There are many SSL certificate resellers - some are well known enterprises with good reputation (e.g. domain name registrars) while others are small and unknown companies.

It is clear that resellers don't have access to private keys of certificates purchased via them (unless private key is given to or taken from the reseller; CSR does not contain private key).

But the tricky part is validation procedures done on reissuance (issuance of similar certificate with different private key, during validity period of the the certificate).

  1. My experience shows that at least in some reseller-CA combinations old certificates are not automatically/immediately revoked when doing reissuance. This leads to situation where several certificates (with different private keys) for the same domain name are valid during the same validity period, bought via the same certificate purchase. There are also some legitimate use cases for this (e.g. if multiple servers serving the same site are secured with the "same" certificate and each server has its own private key). Are there CAs that automatically revoke old certificates during reissuance?
  2. My experience shows that at least in some reseller-CA combinations (at least domain level) re-validation is always done during reissuance. Is there any regulations for CAs enforcing re-validation on every reissuance? Is there a risk that malicious reseller could deceive CA and request a certificate reissuance without the re-validation procedure (i.e. can malicious reseller generate his own CSR, give it to CA/RA and get it signed, claiming his customer is doing reissuance)? If yes, are there CAs whose policies require re-validation on every reissuance?

Basically the question is - is it secure to buy SSL certificates from cheap (and unknown) resellers? Or they can abuse the reissuance process (by fooling CAs/RAs to issue fraudulent certificates)?

  • 1
    This seems a lot like a shopping recommendation question – Rory Alsop Dec 25 '14 at 0:07
  • The question is about regulations and policies of CAs. I suppose answers to this question would be helpful for Stack Exchange users. If you insist, I can remove parts about asking specific CAs or leave only question about regulations requiring CAs to do re-validation on every reissuance. I think that such shortening of the question would cut-out the fact that several certificates with different keys may co-exist (there may be some Stack Exchange users not aware of this). – DavisNT Dec 25 '14 at 0:15
  • You said "at least in some reseller-CA combinations old certificates are not automatically/immediately revoked when doing reissuance". I'm genuinely intruiged. Could you link one CA where automatic (unsolicited) revocation is in the policy? – StackzOfZtuff Dec 25 '14 at 2:51
  • @StackzOfZtuff I do not know any CAs where automatic revocation (of old certificates during reissuance) is in policy. Although I have done very few reissuances. – DavisNT Dec 25 '14 at 14:08
  • @StackzOfZtuff I remember one of my CAs (Namecheap the domain registrar/certificate reseller) automatically revoking for a few days in the aftermath of Heartbleed. :-D – Matt Nordhoff Dec 28 '14 at 6:06
3

It's not any less secure than going directly through a CA. CA's can be compromised just like anyone else. Even if the CA required revalidation, the reseller could just claim to have done it.

2

Typically it's as safe to buy certificates through resellers as it is to buy directly from the CA through whom the reseller is operating. In the end, the relationship is defined by the CA, and the reseller operates within the bounds defined by that CA; if any insecurities exist due to this relationship, then it's the responsibility of the CA to remedy them.

  • Are there any industry standards/regulations or CA policies that require CAs/RAs to always do (at least domain control) validation of end-user upon reissuance? Or there might be cases when malicious resellers abuse reissuance process and get fraudulent CSRs signed without CA/RA contacting customer (end-user) directly? – DavisNT Dec 28 '14 at 15:28
  • The model of the CA industry is based entirely on convincing the browsers to trust them. The browser companies come up with their own rules as they see fit. – tylerl Dec 28 '14 at 17:12
  • The way you should be thinking of CA security is really a weakest link model. The weakest, least trustworthy CA that's included in mainstream browsers is the maximum security that ALL CAs are. They can all issue certificates for all domains AFAIK, so choosing a "secure" one yourself doesn't really add a whole lot. The CA system is essentially broken and needs a better model. But at the moment it's better than all the alternatives. – Steve Sether Jan 28 '15 at 19:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.