My company "ourcompany" owns a 2nd level DNS domain name: ourcompany.org
. We currently use this domain, as well as www.ourcompany.org
and feature1.ourcompany.org
, and have an SSL certificate generated for both these 3rd level domains.
Then we subscribed to a third party hosted service, hosted at ourcompany.thirdparty.org
. They handle SSL and have a certificate whose subject is thirdparty.org
and have the Subject Alternative Name *.thirdparty.org
.
This 3rd party company also provides a functionality to add a custom domain. So we added a CNAME record in our DNS configuration, and now we have feature2.ourcompany.org
pointing to ourcompany.thirdparty.org
. Obviously at this point SSL is not working when accessing feature2.ourcompany.org
.
Then the 3rd party company also asked us to ad TXT DNS entries to prove we are owners of the domain, and they were somehow able to update their SSL certificate and add the following Subject Alternative Names: ourcompany.org
and *.ourcompany.org
.
- How is that not a potential source of Man in the Middle attack? (the 3rd party company can now impersonate us on any of our domains)
- How can an arbitrary 3rd party company generate valid SSL certificates including SAN pointing to a domain they don't own? (their SAN include a lot more things than the CNAME domain record we added)
- Did the certification authority allowed our domains as SAN because of the CNAME record pointing to their domain (in this case, how come the SAN included way more domains than just
feature2.ourcompany.org
), or because of the TXT entry (in this case, could someone point me to a resource explaining this process)?