Hello! There's a story on wired about hackers that not only hijacked DNS records of an online bank but also received a certificate from Let's encrypt: And those sites even had valid HTTPS certificates issued in the name of the bank, so that visitors’ browsers would show a green lock and the bank’s…

hi @salmin That is the whole point of four key initiatives in PKI I am not going to describe these here as they are well documented and google is your friend A) Certificate Transparency B) HTTP Public Key Pinning C) CAA Records D) Restricted Domain List - sites like Microsoft.com can only get …

as a practical exercise review this post: Domain on Restricted List - LetsEncrypt Not Able to Issue Certificate also review Certificate Transparency in action here: https://crt.sh/?q=%.mastercard.ro The reason why this is a good exercise is that it shows someone trying to do something they shouldn…

Thank you very much for your reply. It’s not immediately clear though, whether a combination of these techologies completely cover the case of the a stolen DNS record. Roughly speaking, I’m trying to understand if the same thing could happen to the online bank or site that I use. A) I see a record …

Long story short, I do realize that they’re many initiatives and techonologies aimed at improving the security of PKI. My question is: does LE block the issuance of a certificate if it sees a EV certificate by a different CA in the Certificate Transparency index? Absolutely not. There are many peop…

a full review of the baseline requirements: https://cabforum.org/baseline-requirements-documents/#Baseline-Requirements will give you an idea of what most CAs responsibilities are

People switch CAs, that's perfectly normal. I certainly don't propose to ban that. But how often do people swap an Extended Validation Certificate certificate to a Domain-validated certificate from LE? My guess is "never" or "extremely rarely". If my estimation is correct, then it is reasonable to …

have to disagree again I have worked with clients that have moved from extended validation to domain validation for costs or because their previous IT companies didn’t know the difference ACME is designed to be automated and LetsEncrypt is limited to DV certificates. Having to check a certificates…

I think I get the idea: Migrations from EV to DV by LE are not that rare and should not be pessimized. A DV certificate guarantees nothing but the domain control. Rather than putting efforts into extending DV guarantees (which would kill the ability to get them instantly, automatically and freely)…

If you’re using Firefox or a fork, Certificate Patrol is a nice extension for what you want. Basically, get an alert when a certificate has changed for a site you go to. It is limited to only sites that you have used before, however. It’s also very annoying as certificates are often very prone to ch…

[image] salmin: But how often do people swap an Extended Validation Certificate certificate to a Domain-validated certificate from LE? My guess is "never" or "extremely rarely". If my estimation is correct, then it is reasonable to block such requests until people explain their reasoning on comm…

Extended checks if domain already has a EV certificate

Issuance Policy

ahaw021 April 20, 2017, 2:48pm 17

an interesting 101 post read for you: The CA's Role in Fighting Phishing and Malware

Topic		Replies	Views
Is it safe to use HTTP in domain validation? Client dev	22	4921	November 15, 2016
Why does let's encrypt issue SSL certificates to fraudulent sites Issuance Policy	32	12516	February 5, 2024
Misused certificates Issuance Policy	47	13429	September 7, 2023
Plans for Extended Validation? Feature Requests	47	31215	January 30, 2018
The CA's Role in Fighting Phishing and Malware Issuance Policy	106	25950	November 12, 2019

Extended checks if domain already has a EV certificate

Related topics