1

I bought myself a new domain this month, and found out that there is a 3-year SSL certificate valid for my domain through crt.sh, naturally I contacted Comodo SSL Abuse Dept. and got redirected to the reseller - Namecheap, after reaching out to Namecheap they insisted that as long as I issued a new certificate, the valid certificate that the former domain owner had will have no power whatsoever ( which is not true ), even after ticket escalation, they're just re-assuring me that MITM somehow will not exist as long as I set up a new SSL cert and "there is no need to worry about the security of your website and the information transmitted via Internet".

So, according to Namecheap's statement, Wosign accident is just a fraud and people obtained github.com's certificate will do absolutely no harm to Github. Good to know.

  • It sounds like you either had someone clueless on the phone or they meant that the old one would be revoked if you issued a new certificate through them. Either way, you should probably escalate. – Ryan Bolger Jun 1 '18 at 3:23
  • The sad thing is, I have already escalated the case and this is their "one of the SSL Shift Leaders" giving me the final answer. – Richard Leung Jun 1 '18 at 3:51
  • I did not wanted to post the whole conversation here unless I had to, but they clearly know what I mean and their opinion is as long as I had a new certificate, the valid certificate held by others won't do any harm, which is so ridiculous. – Richard Leung Jun 1 '18 at 3:53
  • Yeah, that's pretty bad. – Ryan Bolger Jun 1 '18 at 4:46
  • While I completely agree with you that they are utterly wrong, I don't see any actual question in your question - much less one that can be answered in the context of this particular site. (Though you might want to look into a CAA record in DNS.) – Jenny D Jun 1 '18 at 7:59
2

Yes, it is (a reason for certificate revocation)

See CAB Forum Baseline Requirements at https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.5.7-29-Apr-2018.pdf and specifically its section 4.9.1.1. Reasons for Revoking a Subscriber Certificate that has this specific point:

The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs:

...

  1. The CA is made aware of any circumstance indicating that use of a Fully-Qualified Domain Name or IP address in the Certificate is no longer legally permitted (e.g. a court or arbitrator has revoked a Domain Name Registrant’s right to use the Domain Name, a relevant licensing or services agreement between the Domain Name Registrant and the Applicant has terminated, or the Domain Name Registrant has failed to renew the Domain Name);

the Domain Name Registrant has failed to renew the Domain Name and hence it may have been registered by someone else, so my reading of this document that each CA must follow means that the initial certificate should be revoked.

  • To add to this correct answer. 1) Send a certified letter in writing to the CA documenting your position and the facts. 2) Namecheap has a gui to revoke certificates - you may have to figure out the login name and then do a password reset since you control the domain now. 3) Unless the old owner can direct DNS traffic to their website using your domain name, their certificate won't work without browsers displaying an error. 4) Switch CA to one that understands security end-to-end and enforces it. – John Hanley Jun 11 '18 at 3:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.