News for hackers. Stuff that matters.

A comment on Netgear Signed TLS Cert Private Key Disclosure. Parent comment

Re:Netgear Signed TLS Cert Private Key Disclosure by rvnx on Monday January 20, 2020 @04:56AM (#22097727)
In case number 2, it's possible to ask CA to reissue n-123123123.netgear.com, and if it's not possible (due to uniqueness verification during key issuing process), to ask n-123132123.netgear.com and the system administrator may not notice.
[ Parent | on HN ]
Re:Netgear Signed TLS Cert Private Key Disclosure by tialaramex on Monday January 20, 2020 @09:34AM (#22099035)
With CAA Netgear gets to decide which CA is authorized for netgear.com and they can cut a deal with that CA for any rules they want.

Facebook, for example, has a deal with their preferred CA which says that all certificates for names under fb.com and facebook.com are only to be issued with authorization from Facebook's central security team.

So even if you can fulfil that CA's normal checking perfectly for fake-bank.facebook.com, if you haven't got someone on the inside of the Facebook security team you can't get a working certificate for your fake bank social media scam.

[ Parent | on HN ]