My company "ourcompany" owns a 2nd level DNS domain name:
ourcompany.org. We currently use this domain, as well as
feature1.ourcompany.org, and have an SSL certificate generated for both these 3rd level domains.
Then we subscribed to a third party hosted service, hosted at
ourcompany.thirdparty.org. They handle SSL and have a certificate whose subject is
thirdparty.org and have the Subject Alternative Name
This 3rd party company also provides a functionality to add a custom domain. So we added a CNAME record in our DNS configuration, and now we have
feature2.ourcompany.org pointing to
ourcompany.thirdparty.org. Obviously at this point SSL is not working when accessing
Then the 3rd party company also asked us to ad TXT DNS entries to prove we are owners of the domain, and they were somehow able to update their SSL certificate and add the following Subject Alternative Names:
- How is that not a potential source of Man in the Middle attack? (the 3rd party company can now impersonate us on any of our domains)
- How can an arbitrary 3rd party company generate valid SSL certificates including SAN pointing to a domain they don't own? (their SAN include a lot more things than the CNAME domain record we added)
- Did the certification authority allowed our domains as SAN because of the CNAME record pointing to their domain (in this case, how come the SAN included way more domains than just
feature2.ourcompany.org), or because of the TXT entry (in this case, could someone point me to a resource explaining this process)?