I stumbled across a huge security vulnerability in a Certificate Authority that is trusted by all modern browsers and computers.

Specifically, I am able to get a valid signed certificate for a domain I don't own. If I had the means to become a Man In The Middle, I would be able to present a perfectly valid ssl certificate.

This vulnerability required no SQL injections or coding on my part. I quite figuratively stumbled across it.

What is the proper way to report this? I want to be ethical and report it to the offending CA, but I also don't want them to simply fix the vulnerability and then sweep everything under the rug. This problem seems to have been there a while, and I'm simply not smart enough to be the only one capable of finding it.

I'm concerned that solely contacting the CA will result in a panic on their part, and they, fearing a DigiNotar-like incident, will do anything to keep the public from finding out.

Am I allowed to also contact some major players, such as other certificate authorities or other sites such as CloudFlare or Google? (I know CloudFlare was given a heads-up about HeartBleed before the public announcement went out.)

Note: I'm posting under a psuedonym account to (try to) remain anonymous for now.

Edit: This question is related to another question, but I feel this vulnerability falls outside the scope of that question. This could affect essentially the entire internet (ie everyone online is a customer), and my question explicitly states that simply contacting the 'developer' (the accepted answer for the linked question) doesn't seem like the best first step to me.

Edit 2: I've gotten in contact with some people, and they've advised me to avoid talking further on this forum (sorry guys!). I'll update this question later, after the vulnerability has been fully fixed and any incorrect certificates revoked.

Edit 3: The details are out. I've posted more information on my personal site about the specifics of the vulnerability. The story is still ongoing, and you can read the discussion between Mozilla, Google, and the CA WoSign.

Edit 4: As promised, I'm updating with a link to an article written by Ars Technica regarding this and other incidents involving WoSign. Looks like WoSign and StartCom (now owned by the same company) may be in serious danger of root revocation.

  • 4
    Hi, did anything ever come of this? If there's a URL of an advisory or something, that would be interesting!
    – paj28
    Commented Jan 11, 2016 at 12:09
  • 1
    Was this you? oalmanna.blogspot.co.uk/2016/03/startssl-domain-validation.html
    – paj28
    Commented Mar 23, 2016 at 14:23
  • 5
    @paj28 No, that wasn't me. But I finally got around to contacting Ars Technica to see if they want to do anything with my info. I'll update this question with more details later with more details. Either with a link to the story, or (if no one cares to write a story (>1 year old news now)) with specifics about the now-fixed vulnerability. Commented Aug 2, 2016 at 20:34
  • 14
    To anyone wondering what happened: schrauger.com/…
    – Jon
    Commented Aug 31, 2016 at 23:13
  • 10
    Woah. Looks like two CAs are now going to be distrusted by Firefox, partly as a result of this. docs.google.com/document/d/…
    – Ajedi32
    Commented Sep 27, 2016 at 14:25

8 Answers 8


Such a claim is generally quite serious.

While reaching out to the vendor in question is a responsible matter, you should certainly consider notifying the relevant root store security teams, since they are responsible for designing, evaluating, and applying the security controls to prevent this, and will likely need to directly work with the CA to ascertain the issues.

In terms of responsible disclosure you should also immediately report this to each of the major root store operators: Google, Microsoft, Apple, Mozilla. Just search for "<vendor> report security bug", and the first result will tell you. These are just some of the vendors affected - e.g. not just the CA.

If you are unsure about how to do this, wish to remain anonymous, or need assistance coordinating, the Chromium security team is happy to investigate, contact the appropriate CA, and coordinate with the broader industry. See https://www.chromium.org/Home/chromium-security/reporting-security-bugs for details.

  • 6
    I changed my accepted answer to this one. After everything that's happened, this is the advice I should have originally gone with. If it involves Certificate Authorities, the root store operators should be contacted along with the CA in question. Commented Sep 27, 2016 at 19:21

It sounds like your issue is that this vulnerability is bigger than you know what to do with.

The rules of responsible disclosure, as decribed here, say that you should contact the vendor and negotiate a period of time - between 1 week and 6 months, depending on the depth of the changes required - in which they can implement a patch, revoke and re-issue certificates, publish security bulletins, etc, before you go public with your findings. The intention is that at the end of the negotiated period you get your public recognition, but your going public can't do any more harm - if the vendor has done their job properly.

If figuring out how to contact them / negotiate a Responsible Disclosure period, go public with your results at the end, etc, is too big for you, or you don't know how to get started, then I suggest contacting and partnering with a well-known security researcher who already has established publication channels. Find a big name who has already published similar vulnerabilities and call them up! It sounds like you won't have any problem getting their attention.

Also congratulations! I look forward to seeing your name on a paper in 6 months!

  • 13
    If you need help working out a disclosure agreement, or just the logistics of contacting the vendor, then I suggest working with a responsible third party like the Electronic Frontier Foundation or SANS Institute.
    – Rache
    Commented Jun 10, 2015 at 18:16
  • 2
    There is another school of disclosure: Full disclosure. I don't necessarely agree with them but it's good to know people don't all agree responsible disclosure is responsible. Commented Jun 12, 2015 at 19:17

Congratulations! Sounds like a major find.

First, generate some proof. The github.com SSL certificate sounds like a great start. Make sure you keep all the network traces you need to show exactly what happened.

You need to determine if you broke any laws or T&Cs while doing this. If the CA does not have a bug bounty, you almost certainly did. In that case, it is important for you to stay anonymous. One concern here is that you may have already revealed your identity during the testing. For example, you probably had to pay for that certificate; how did you make the payment? If you've already broken the law in a non-anonymous way, this pretty much rules out any strong arm tactics against the CA.

While it's commendable that you want to reach out to the CA, bear in mind that you do have a possibility of selling this vulnerability. This would potentially be worth $100,000 from an organisation like vupen. Up to you how you feel about that.

If you do want to disclose, you could do it yourself, but I agree with Mike's recommendation to reach out to an established researcher. I think you could aim a little higher than a university researcher. A celebrity like Bruce Schnier or Dan Kaminsky would be interested in this. You would have to trust them with the details, and use their weight to have the issue taken seriously.

Regarding CloudFlare getting an early view of HeartBleed, this is standard practice for major vulnerabilities - that key providers get an early warning. But that comes much later in the process. In the case of HeartBleed, after patches had been developed (but not publicly released). I'm not sure how that would apply to this vulnerability. It seems that every certificate issued by the CA is now suspect.

Whatever you choose to do, good luck!

  • 14
    lol - "it's thought that many of the purchasers are law enforcement and "friendly" intelligence, which most people find a little more palatable" -- not to people who live in the other 195 countries! Commented Jun 10, 2015 at 15:04
  • 1
    @paj28 If they value privacy and freedom like i do, i would never sell any exploit to any law enforcement or intelligence agencies, no money can buy freedom :)
    – Freedo
    Commented Jun 10, 2015 at 18:23
  • 2
    ". I'm not sure how that would apply to this vulnerability. " - probably the equivalent would be to release it to browser vendors, OS vendors, etc, so that they can issue a routine update quietly removing the offending root certificate (after customer certificates have been updated to a new one that is not compromised) May not be necessary if a CA has a paper trail that can find if any certificates (other than OPs) were in fact fraudulently issued.
    – Random832
    Commented Jun 10, 2015 at 20:08
  • 2
    @paj28 this is why the citizens that should stand for to make this market illegal, why should be legal to sell exploits to the government and if you sell to criminals you are a criminal ? I don't see the difference and this problem will be very hard to solve using technology only
    – Freedo
    Commented Jun 10, 2015 at 20:25
  • 2
    1. Please don't sell this vulnerability. 2. If you do need to issue a cert as a proof of concept, do it securely, as described here: agwa.name/blog/post/how_to_responsibly_misissue_a_cert
    – AGWA
    Commented Jun 12, 2015 at 21:08

When unsure, you can also contact CERT: https://forms.cert.org/VulReport/

They have experience in dealing with even very serious security vulnerabilities, and are generally considered a trusted party. At least they can confirm that your assessment of the vulnerability is correct, and document your part in finding it.

While CERT generally advises you to contact the vendor yourself, for a big case like this I'm sure they would offer assistance.

  • 16
    I work for CERT. We'd be happy to help coordinate this vulnerability.
    – Ed McMan
    Commented Jun 11, 2015 at 13:44
  • 1
    @EdMcMan depending on the timing there (unless you're the party he spoke to) he may have missed you Commented Jun 12, 2015 at 2:33

Ryan Sleevi has very good advice regarding this.

Before sounding off too many alarms, I would contact the Chromium Security Team as he has advised, just to make sure that you are not misunderstanding anything.

Have you checked your vulnerability against the CAB Forum Baseline Requirements to see if the execution of your vulnerability breaks those rules: https://cabforum.org/baseline-requirements-documents/?

For instance, I know of a issuance practice that seems to match up with your summary, but AFAIK is totally valid and not a vulnerability in the eyes of the CAB Forum. A certificate can be generated for a subdomain without having control over the root. I.e. you can get a certificate for test.google.com without having to demonstrate control over google.com.

  • 2
    Trying to get a certificate for security.stackexchange.com without demonstrating control over stackexchange.com would be a similar example. Commented Jun 11, 2015 at 21:32
  • Really? My god I had no idea. How can any user validate which subdomain he should be on?
    – bbsimonbb
    Commented Nov 18, 2015 at 8:53

Operating system and browser vendors might be a good place to report such a vulnerability to since they manage the root CA lists. Here are a few relevant links:

  • www.google.com/about/appsecurity/
  • www.mozilla.org/en-US/about/governance/policies/security-group/bugs/
  • www.apple.com/support/security/
  • technet.microsoft.com/en-us/security/ff852094.aspx

I would recommend that you obtain documentation and demonstration of the vulnerability as you are aware of it. Ideally if you can have this verified entirely by a third party, who has been read in to the situation.

To avoid issues of integrity or vendor repudiation of the advice on the vulnerability against you, additional proof by demonstration/execution is necessary. Since we are taking a cert related, capturing a certificate chain demonstrating a the fault would be ideal. Of course any session captures that show the vuln in action is useful.

Without full disclosure I'm just guessing what proof you need anyways. Take the proof of exploit documentation and seed into publicly visible locations like GitHub, Pastebin, email lists. This locks in the inability to repudiate if your evidence is strong.

The remaining issue is identity and communication with the vendor and public. I won't bother disusing revelation of your personal identity, it is up to you. Communications, if you want to be hands on, and prepared to screw up or not act with experience in the case say the whole thing blows up or goes sideways, you can do the contact.

Alternatively seek representation, from either the community, EFF or at the very least your attorney. Someone to protect your interests is advisable and think carefully before accepting industry help from a businesses in its commercial capacity. I am sure the community here can recommend some choices on representation if you solicit such advice.

An entire book could be written on this set of topics, I've tried to keep it short and out of TLDR; territory.

Also on a side note, thank you for the time you have spent uncovering this potential vulnerability. It is badly needed.


You can also report it to "[email protected]" but realize that if the CA in question is a CA/B Forum member, they will also see it. However, so will all the other CA and Browser members. Another option is to report it to the CA Security Council, an organization of the 8 largest public SSL issuers in the world. This is an industry group that has an interest in upholding high standards for its members as well as promoting best practices among all CAs. The form is here: https://casecurity.org/contact-us/

  • Could people downvoting this please explain the reasoning behind it?
    – cnst
    Commented Jun 11, 2015 at 4:03
  • This page is heavily advertising oriented. The contact link goes to "Media Contacts – Connect Marketing."
    – Jeff Ferland
    Commented Jun 11, 2015 at 6:37
  • 1
    This now seems okay. Maybe they have improved the page. Undeleted.
    – Rory Alsop
    Commented Jan 3, 2019 at 15:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .