How to revoke a certificate without account key or email

[mnordhoff]

@pogsoft

if the attacker tries to renew the certificate before 90 days have passed, would he be able to do it without validating the domain again? This would give him another valid certificate for further 90 days without having access to the domain. Is that right?

Yes. The validation -- authorization -- lasts for a certain amount of time. I think it's currently 90 days, though they intend to lower it further: Upcoming API changes The attacker can continue issuing certificates until it expires, covering a total of about 179 or 180 days.