24

Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online).

  • First of all, how can they ensure that you really are an admin of shop.example.com? Perhaps it was an attacker who requested this certificate to be able to perform a man-in-the-middle attack.

  • And secondly, let's say it really was you, and you got that certificate. What prevents the same attacker requesting a certificate for the same domain from some other CA?

  • Is there a common storage of all requests so that CAs can detect such duplicates easily? Or is there some other means of preventing it?

  • Can someone also easily get a certificate for shop.example.net and hope for some mistyping users?

  • 4
    Nothing prevents them from requesting such certificates. ​ (Whether they get such certificates is another matter.) ​ ​ ​ ​ – user49075 Jul 24 '15 at 13:52
  • Thanks everyone for lots of good answers, I would like to accept all of them, unfortunately it's not allowed :) – Ilya Chernomordik Jul 24 '15 at 14:16
  • 2
    If you want to be really sure that no-one will use fake certificate, then you should setup HPKP. – Vilican Jul 24 '15 at 15:25
  • 1
    DANE/TLSA can also prevent against that sort of attack (if browsers would start to verify is ootb). Also, the "common" MITM case is, that someone can modify data for some client-base (e.g. admin can MITM everyone inside some free WiFi). To MITM your server and all of the internet (at least the IPs of the CA) is a lot harder. Your server and the CAs server are in some hosting facilities and won't use free WiFis. Still, the CA system basically just sucks. – Josef Jul 26 '15 at 8:05
32

A CA is supposed to make sure that the certificates it issues contain only truthful information. How they do that is their business; serious CA are supposed to publish detailed "Certification Practice Statements" that document their procedures.

In practice, when you want to buy a certificate for a www.myshop.com domain, the CA "challenges" you, so that you demonstrate that you indeed have control of that domain. Some classic methods include:

  • The CA sends you a piece of random data, to include as a host name in the domain. You thus demonstrate your control of the DNS related to the domain.

  • The CA sends you a piece of random data that you must put for download (over plain HTTP) from the www.myshop.com site. You thus show that you control the main server that corresponds to the domain.

  • The CA sends that piece of random data over an email sent to admin@myshop.com. You return back that data to them, thereby demonstrating that you can read the emails sent to the administrator of the domain.

None of these mechanisms is really strong; and, moreover, it suffices for an attacker to succeed in fooling one CA among the hundred or so that are trusted by default by usual Web browsers. Nevertheless, fraudulent certificates appear to be a rarity (say, once or twice per year, worldwide), so one has to admit that these authentication mechanisms, however flimsy they look, must be good enough for the job.

As for mistyped domain, it is a very classic method which is commonly handled by either buying those mistyped domains, or unleashing your lawyers on whoever tries to buy a domain that seems to be "too close" to your own domain.

  • Thank you for the answer, with regards to the mistyped domain until all these layers do their job the attacker can do some damage as some percentage of the users will be using that bad site. So from CA's point of view nothing prevents them from issuing such certificates or they do some checks for that as well? – Ilya Chernomordik Jul 24 '15 at 14:03
  • 4
    @IlyaChernomordik The certificate providers check that you own the domain for which you want a certificate. They don't check whether it's a typo for another domain -- how could they? All domains are potentially typoes for other domains, and so if no certificate could be issued to a potential typo, then no certificates could be issued at all. – Mike Scott Jul 24 '15 at 14:05
14

Certificate Authorities make a living based on their reputation of only giving out certs to the rightful admins of a domain. If a CA starts giving out too many fraudulent certs, the browsers will pull out their root cert and the CA goes bankrupt, so it's in the CA's best interest not to do this.

Exactly how a CA verifies the identity of the applicant varies by CA, and by how much the customer is willing to spend on the cert. In broad strokes, there are different levels of certs: Domain Validated (DV) which does only automated checks, and Extended Validation (EV) which requires human-to-human validation like phonecalls with the applicant company's CEO, face-to-face meetings, etc but are more expensive to purchase.

To answer the question, In the simplest DV case, what prevents a man-in-the-middle from getting a cert for your domain? Common verification methods include:

  • Prove that you can receive email at one of the following addresses: admin@<domain.com>, administrator@<domain.com>, hostmaster@<domain.com>, postmaster@<domain.com>, webmaster@<domain.com>, in addition to being able to receive email at the address listed in the domain's WHOIS listing. (example: GlobalSign)

  • They give you a block of HTML, including (I believe) the hash of the Certificate Signing Request (CSR) you sent, that you have to insert into the homepage of your site. This proves that the applicant has admin rights on the server. (example: GlobalSign)

  • Place the hash of the CSR in a .txt file in the root of your domain, ex.: http://yourdomain.com/<Upper case value of MD5 hash of CSR>.txt. (example: Comodo)

  • What you have described applies to DV or to EV only? – Ilya Chernomordik Jul 24 '15 at 14:12
  • 1
    What I have described applies only to DV since it is entirely automated. EV will use much stronger methods like requiring a signed letter from the company's CEO and checking it against the company's public registration with the government, then checking that against <domain.com>'s WHOIS record, etc. Unfortunately those checks can not be automated. – Mike Ounsworth Jul 24 '15 at 14:16
  • I see, so whenever we see the green company name in the browser that means it has been checked by humans? And hope that CA's don't just get more money for the same level of verification as DV :) – Ilya Chernomordik Jul 24 '15 at 14:18
  • 1
    It's also worth noting that DV certs will show a lock icon in your browser, but will not make the address bar turn green. Only strongly validated EV certs will make the bar turn green. So as an end-user you can tell which sites have the cheap DV certs. – Mike Ounsworth Jul 24 '15 at 14:19
  • The CA/Browser Forum sets strict guidelines on what things a CA must check before issuing an EV cert. If a CA is caught giving out EV certs without doing all the proper checks, they can get in BIG BIG trouble. – Mike Ounsworth Jul 24 '15 at 14:21
5

how can they ensure that you are really an admin of this myshop.com, perhaps it was an attacker who requested this certificate to be able to perform man in the middle attack?

They can't. If you can receive mail for admin@example.com then you can get a cert for that site.

what prevents the same attacker from requesting the certificate for the same domain from some other CA?

Nothing. However a request for a certificate for a high value domain may trigger internal alerts and manual checks. What exactly a "high value domain" is, isn't specified. Maybe the Alexa Top 10000 websites or something. (The CABForum's Information for the Public info page talks about this. (Archived here.))

Can someone also easily get a certificate for myhsop.com and hope for some mistyping users?

In principle, yes. With the "high value domain" exception mentioned above. Details of how the CAs try to detect similarity (and to what) is not public knowledge either.

Is there a common storage of all requests so that CAs can detect it easily or some other means of preventing it?

No. But there is Google's "Certificate Transparency" (CT) initiative. The idea is there is a public log of all issued certs. And you as a worried domain owner could then watch these logs to see if there have been any newly issued certificates for one of your domains. This would at least allow double issuings to be detected after the fact quickly. -- If and only if all CAs actually participate in the CT effort. And if browsers enforce this. (No log entry? No traffic!)

4

Since all of the other subquestions have been adequately answered, I will attempt to answer the question regarding registration of domains that are similar to the original.

This action is known as typosquatting and since the typosquatter owns the domain, they will have complete control over the verification requests that the SSL certificate authority sends. Therefore, they will be able to obtain a certificate, which is for all intents and purposes legitimate to the CA.

The only techniques to defend against this form of attack would be to either defensively acquire typo domains, or to take legal actions against the typosquatters, as Lego has done.

3

A provider of domain-validated certificates will typically ask you to create a TXT DNS record of their choosing for myshop.com or put online a web page of their choosing on http://myshop.com/, to prove that you own the domain. That will generally stop an attacker from getting an SSL certificate for your domain, unless they have already compromised your DNS or your web server. For EV certificates (the ones that generally give a green bar in the browser) the checks are more rigorous, which is why those certificates are more expensive.

There's no central register of SSL certificate requests, and so they can't be cross-correlated between different CAs as you suggest.

Anyone who owns the domain myhsop.com can get an SSL certificate for that domain. If you're worried about typos, register the domains for the typos you're worried about.

  • It sounds it should take time for you to prove you can get the certificate, how happens they promise to issue it within few minutes? Is it just "misleading" ads? – Ilya Chernomordik Jul 24 '15 at 14:04
  • 4
    You should be able to create a DNS record or a new web page in a few minutes. If you can't, then that's your problem, and you won't get your certificate in a few minutes. – Mike Scott Jul 24 '15 at 14:11
  • I were never asked to create a DNS entry. Most just send emails. Geotrust for example does a phone call. – sebix Jul 25 '15 at 8:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.