14,766 Let's Encrypt SSL Certificates Issued to PayPal Phishing Sites

Re:14,766 Let's Encrypt SSL Certificates Issued to PayPal Ph... by nikanj on Sunday March 26, 2017 @01:37PM (#13961913)

And Symantec lost their certification rights because they issued certificates to test.com and example.com?

[ Parent | on HN ]

Re:14,766 Let's Encrypt SSL Certificates Issued to PayPal Ph... by tokenizerrr on Sunday March 26, 2017 @01:43PM (#13961964)

Did the requesters of that actually control those domains (hint: they didn't)? If I register the domain superawesomepaypalscam.com then that is my domain name. Since it is my domain name and I can control it, obviously I can get a domain validated SSL certificate for it.

If I don't control example.com, then obviously I should not be able to get a domain validated SSL certificate for it. If I did, I would be able to MITM people trying to visit example.com (which is not my website), and that is bad.

This entire situation is basically working as intended.

[ Parent | on HN ]

Re:14,766 Let's Encrypt SSL Certificates Issued to PayPal Ph... by wolf550e on Sunday March 26, 2017 @01:41PM (#13961945)

You are allowed to have paypal.nikanj.com and a CA is allowed to give you a certificate for it. Some people use them for PayPal IPN.

Symantec generated certificates for domains Symantec did not control.

[ Parent | on HN ]

Re:14,766 Let's Encrypt SSL Certificates Issued to PayPal Ph... by phonon on Sunday March 26, 2017 @01:46PM (#13961974)

...that they didn't own!

[ Parent | on HN ]