[cabfpub] Non-whitelisted email addresses used for DV issuing

[Ryan Sleevi]

I had also contacted CERT for more evidence of the CAs affected. Several
CAs listed as affected, when reviewing their CPS, clearly indicated
otherwise.

It's unclear what evidence exists, other than that reseller page. That
said, I have noted numerous resellers making claims of acceptable email
addresses that are not in line with the issuing CA's CPS. I can assume this
is caused by out of date information by the reseller, and not an accurate
statement of reality, for as Gerv notes, the whitelist of acceptable emails
is abundantly clear.

This may be a good opportunity for CAs to reach out to their resellers and
ensure correct and current documentation. Obviously, it can reflect poorly
on the CA when the reseller is making inaccurate claims - and reflects even
poorer if the claims are accurate.
On Mar 30, 2015 5:37 AM, "Adriano Santoni - Actalis S.p.A." <
adriano.santoni at staff.aruba.it> wrote:

>  That list cought me by surprise, as I am not aware that we allow
> non-white listed email addresses. Besides, to date we have not even started
> checking domain control by email....
>
> I contacted CERT to try and find out how they figured out which CAs are
> "affected" and which not (apart from reading CPS's).
>
> Adriano
>
>
> Il 30/03/2015 12:07, Gervase Markham ha scritto:
>
> Hi everyone,
>
> On 30/03/15 10:47, Sigbjørn Vik wrote:
>
>  According to http://www.kb.cert.org/vuls/id/591120, some issuers use
> non-whitelisted email addresses to verify domain ownership.
>
>  Thanks for bringing this up. This came to Mozilla's attention over the
> weekend as well. Could all CAs please check that they and their RAs are
> conforming to the BRs on this issue?
>
> BRs 11.1.1.4 say:
>
> "11.1.1 Authorization by Domain Name Registrant
>
> For each Fully-Qualified Domain Name listed in a Certificate, the CA
> SHALL confirm that, as of the date the Certificate  was  issued,  the
> Applicant ... either is the Domain Name Registrant or has control over
> the FQDN by:
>
> ...
>
> 4. Communicating with the Domain’s administrator using an email address
> created by pre-pending ‘admin’, ‘administrator’, ‘webmaster’,
> ‘hostmaster’, or ‘postmaster’ in the local part, followed by the at-sign
> (“@”), followed by the Domain Name, which may be formed by pruning zero
> or more components from therequested FQDN"
>
> Mozilla believes the BRs are clear here: it is not acceptable to issue
> certs using email confirmation where the email address is not either in
> the relevant parts of WHOIS or has a localpart which exactly matches one
> of those five options.
>
> Gerv
> _______________________________________________
> Public mailing listPublic at cabforum.orghttps://cabforum.org/mailman/listinfo/public
>
>
> --
> *Adriano Santoni*
>
> _______________________________________________
> Public mailing list
> Public at cabforum.org
> https://cabforum.org/mailman/listinfo/public
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://cabforum.org/pipermail/public/attachments/20150330/d9541aab/attachment.html