Security risk of using single account

You are confuing:

  • having a valid certificate
    with
  • being able to obtain a valid certificate

Obviously, anyone with a valid certificate poses a real threat for a MITM attack.

Clearly anyone that obtains a previously used domain name, or moves a domain name from one hosting company to another, needs to do their due diligence to ensure all related certs have expired or have been revoked (and no new certs have been issued without their consent) before using such a domain for critical/secure connections.

3 Likes

It is negligible because this scenario has the same exact risks already inherent to every multi-tenant system – trust in the third party infrastructure provider. The caching of authorizations is largely irrelevant to this threat model on a practical level, as they are unnecessary and a variant of a well known concern: the root concern here is because a PrivateKey is not being managed by the domain's owner, but is instead proxied to a trusted infrastructure partner.

Ultimately, there is little difference between these two scenarios:

  • SubscriberB exploits a vulnerability in a System to obtain a Certificate for Domain1, while both are hosted on the System.

  • SubscriberB exploits a vulnerability in a System to obtain a Certificate for Domain1 using cached authorizations after SubscriberA removes Domain1 from the system.

In both situations, the exploitation is abusing a vulnerability in the infrastructure provider's system. The involvement of Cached Authorizations shows where LetsEncrypt has room for improvement, but it doesn't seem to introduce any new threat.

While I recognize the theoretical concerns here, and I would actually love to see a mechanism to delete authorizations cached against another account, this isn't really a viable attack vector that anyone should be concerned about.

I'm not saying there is no concern, but the SSL Certificate ecosystem is not nearly as secure as people often think and IMHO this concern is negligible. Keep in mind, the Baseline Requirements state a window of 398 days, and IIRC the OCSP framework allows a 10 day cache. There is a constant tradeoff between scalability and safety, and this concern is just along the lines of what the industry - as a whole - has deemed negligible for now.

4 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.