DigiCert: Internal domain name certificate misissuance
On 10/16/2018, DigiCert was notified by a third party that an internal name appeared on a publicly issued certificate within the past week. DigiCert investigated and identified a gap in its domain pre-validation process that allowed a certificate containing an internal name to be submitted for validation by a customer. DigiCert stated that a validation agent overrode the base domain’s classification as “private” and manually performed a WHOIS procedure, which enabled the agent to send a domain confirmation email and the customer to approve the internal name in response to the method 2 confirmation. DigiCert also explained that the override was intended to be used when automated WHOIS data retrieval failed, but it unintentionally allowed incorrect approval for WebPKI issuance. On 10/17/2018, DigiCert revoked the one problem certificate and moved the pre-issuance check behind the validation process so internal names are blocked for public certs regardless of validation staff mistakes. DigiCert also implemented portal changes to prevent the gap that allowed internal names into domain pre-validation for WebPKI and improved pre-issuance linting; it ran a script over its existing certificate database and reported no additional affected certificates. The bug was marked RESOLVED with resolution FIXED.
- DigiCert was notified by a third party about a publicly issued certificate containing an internal name.
- DigiCert revoked the problem certificate and implemented fixes to block internal names for public issuance.
- DigiCert — Brenda Bernal described how DigiCert became aware of the issue, the root cause in domain pre-validation/WHOIS override behavior, and the corrective actions taken (revocation, process change, portal changes, and linting improvements).
- Fastly representative — Wyane Thayer asked DigiCert to post the report to mozilla.dev.security.policy and requested an explanation of how pre-issuance linting missed the issue.
- DigiCert — Jeremy Rowley explained that DigiCert used a modified cablint that warned but did not block, replaced it with zlint, planned to hard-fail it, and provided a detailed account of how the linter warning was bypassed and DCV proceeded.