SSL.com DCV bug caused mis-issuance via email-based domain validation

SSL.com reported a domain validation bug that caused misinterpretation of domain ownership in its email-based DCV flows, leading to mis-issued DV TLS certificates. The issue was first raised by a third-party security researcher, and SSL.com later confirmed that the problem affected BR 3.2.2.4.14 (Email to DNS TXT Contact) and also BR 3.2.2.4.2 (Email to Domain Contact). SSL.com said it disabled the affected validation method, revoked the reported certificate, identified additional affected certificates, and published incident reports and remediation updates. The company stated that all affected certificates had been revoked and that it deployed a patch plus new unit and integration tests for email-based validation methods. The bug was ultimately closed after SSL.com posted a report closure summary and requested closure.

1. 2024-02-12 A callback change introduced a validation bug that could link certificate requests to the approver’s email domain instead of the requested domain.
2. 2025-04-18 A third-party report identified a DCV bypass that led to mis-issuance of a DV TLS certificate.
3. 2025-04-18 SSL.com disabled validation method 3.2.2.4.14 and revoked the reported certificate.
4. 2025-05-02 SSL.com filed its full incident report and listed 11 affected certificates.
5. 2025-05-23 SSL.com said it had completed expanded test coverage for email-based validation methods.
6. 2025-06-18 SSL.com issued a report closure summary stating that all action items were complete.

1. 2025-04-18 Community commenter — The reporter described a DCV bypass in SSL.com’s BR 3.2.2.4.14 flow and cited one affected certificate.
2. 2025-04-18 SSL.com — SSL.com acknowledged the report and said it was investigating.
3. 2025-04-18 SSL.com — SSL.com said it had disabled DCV method 3.2.2.4.14 for all SSL/TLS certificates while investigating.
4. 2025-04-21 SSL.com — SSL.com posted a preliminary incident report saying the certificate had been revoked and that ten additional affected certificates had been found and revoked.
5. 2025-04-21 SSL.com — SSL.com disclosed the list of all affected certificates and said full details would be provided in the final report.
6. 2025-04-21 SSL.com — SSL.com said the issue did not affect systems and APIs used by Entrust.
7. 2025-04-22 SSL.com — SSL.com said it supported 3.2.2.4.13 manually but had not automated it, and that only 3.2.2.4.4 and 3.2.2.4.14 were actively supported as automated email processes.
8. 2025-05-02 SSL.com — SSL.com attached a list of affected certificates.
9. 2025-05-02 SSL.com — SSL.com filed the full incident report, stating the bug affected 11 DV TLS certificates and that issuance using 3.2.2.4.14 had been disabled within two hours of the report.
10. 2025-05-07 SSL.com — SSL.com said the flaw came from an external architectural change and that it had expanded test coverage for cases where the approver email domain differs from the validated domain.
11. 2025-05-14 SSL.com — SSL.com reported that the patch for 3.2.2.4.14 had been deployed to staging and production, but the method remained disabled in production pending more testing.
12. 2025-05-23 SSL.com — SSL.com said expanded unit and integration tests for email-based validation methods were completed and that all action items were complete.
13. 2025-06-04 SSL.com — SSL.com provided statistics on email-based validation usage and described improvements to monitoring, audits, and internal controls.
14. 2025-06-18 SSL.com — SSL.com posted a report closure summary and requested that the bug be closed.
15. 2025-06-25 CCADB representative — CCADB issued a final call for comments and said the report would be closed around 2025-07-02.