← Buypass cases
Bugzilla #1838421
Ca Certificate Compliance
Buypass: Domain validation method using not allowed domain contact
RESOLVED
FIXED
Buypass
This summary was auto-generated by AI and revised by me when needed — accuracy improves with each update.
Always refer to the official Bugzilla thread as the authoritative source.
If you spot an inaccuracy, let me know via the contact form.
AI Summary
Buypass reported an incident involving a TLS certificate issued using an incorrect domain validation method. The CA discovered that a validation specialist mistakenly used an email address from the DNS CAA iodef property instead of the allowed domain contact. The incident was identified on June 13, 2023, immediately after the certificate was issued, and the certificate was revoked the same day. Buypass has since ceased using external DNS tools for manual validations and has provided additional training to its validation specialists to prevent future occurrences. A new incident report was registered to address the situation comprehensively.
Chronology
- Buypass discovered a misissuance incident involving an incorrect domain validation method.
- Buypass confirmed they would stop using external DNS tools for validations.
- Buypass registered a new bug with a detailed incident report.
Thread Activity
- Buypass — Buypass reported an incident involving a TLS certificate issued based on an illegal domain contact.
- Mm representative — Questions were raised regarding the manual validation process and the use of external DNS tools.
- Buypass — Buypass confirmed they would stop using external DNS tools for manual validations.
- Buypass — Buypass registered a new bug with a new incident report.
Participants
Buypass
Mm representative
External References
Similar Local Cases
Buypass: Domain validation method using externally operated DNS tools
Buypass: TLS certificates with incorrect Subject attribute order
e-commerce monitoring GmbH: CN domain not in SAN
Camerfirma: suspicious certificate for com.com
e-commerce monitoring GmbH: Revoked test website not using revoked certificate
IdenTrust: Mis-Issued EV Certificates
Camerfirma: certificate for unregistered domain cuatis.net
GoDaddy: Certificates with invalid embedded SCT signatures