https://www.theregister.com/2025/04/22/ssl_com_validation_flaw/
Certificate issuer SSL.com’s domain validation system had an unfortunate bug that was exploited by miscreants to obtain, without authorization, digital certs for legit websites. With those certificates in hand, said fraudsters could set up more-convincing malicious copies of those sites for things like credential phishing, or decrypt intercepted HTTPS traffic between those sites and their visitors. And since learning of that flaw, SSL.com has revoked 11 wrongly issued certificates – one of them for Alibaba. The hole appears to be as simple as this: As part of the process of verifying that you control a domain name – and thus allow you to obtain a TLS certificate for that domain so that it can (for instance) support encrypted HTTPS connections with visitors – SSL.com gives you the option of creating a _validation-contactemail DNS TXT record for the domain, with the value set to a contact email address. Once that DNS TXT record is present, and you request a certificate for the domain, SSL.com emails a code and URL to that contact address. You click the link and enter the code, and establish you are a controller of the domain and can get the certificate for your site. Unfortunately, due to a buggy implementation, SSL.com would also now consider you the owner of the domain used for the contact email. If you put in vulture@example.com, provided you could pick up mail to that address and follow the link, SSL.com would be happy to issue you a certificate for example.com. It doesn’t matter what domain you were actually trying to verify ownership of. Swap example.com for a webmail provider, and suddenly this becomes a bit of a scary situation. … It’s important to note the certs created for these domains may not have been obtained maliciously; all we know is that they were issued via the broken validation system, which means they need to be revoked as a precaution. In a preliminary incident report posted on Monday, SSL.com technical compliance officer Rebecca Kelley confirmed there was a flaw in one of its domain control validation (DCV) methods. …
Not normally in my wheelhouse, but still good to know from a Security POV.
Regards