A prominent certificate authority (SSL.com) has disclosed a significant security vulnerability in its domain validation system that could allow attackers to obtain fraudulent SSL certificates for domains they don’t own. SSL.com’s validation system incorrectly marked the hostname of an approver’s email address as a verified domain a serious departure from proper security protocols. Rebecca Kelley, assigned to handle the incident, announced that the company had “disabled domain validation method 3.2.2.4.14 that was used in the bug report for all SSL/TLS certificates” while they investigated the issue. This event underscores the need for ongoing vigilance from both certificate authorities and domain owners, as well as the importance of rapid detection and remediation of vulnerabilities to maintain confidence in the public key infrastructure that secures the internet. “SSL.com verified and issued aliyun.com…. I’m not administrator, admin, hostmaster, postmaster, or webmaster of aliyun.com. and also, _validation-contactemail with the value of my email is never configured for aliyun.com. So, this is wrong,” the researcher said. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The ability to obtain fraudulent certificates could potentially allow attackers to impersonate legitimate websites, conduct man-in-the-middle attacks, or intercept encrypted communications.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 22 Apr 2025 13:20:14 +0000