Introduction

Certificate Authority (CA) misissuance occurs when a CA issues an SSL/TLS certificate for a domain to someone who does not control that domain. This can happen through social engineering, CA process failures, or validation bypass. The fraudulently issued certificate can be used for man-in-the-middle attacks, phishing, or impersonation. When misissuance is discovered, the certificate must be revoked immediately and all legitimate certificates may need to be reissued.

Symptoms

  • Certificate Transparency (CT) log shows an unexpected certificate for your domain
  • crt.sh search reveals certificates you did not request
  • Browser shows a valid certificate for your domain that you did not install
  • Security researcher reports unauthorized certificate issuance for your domain
  • CA notifies you of a validation process breach affecting your certificates

Common Causes

  • CA validation process bypassed through DNS or email control compromise
  • Social engineering attack on CA staff to issue a certificate
  • Automated validation vulnerability (e.g., CAA check bypass)
  • Compromised domain registrar account used to pass domain validation
  • CA internal process failure or misconfiguration

Step-by-Step Fix

  1. 1.Identify the fraudulently issued certificate:
  2. 2.```bash
  3. 3.# Search Certificate Transparency logs
  4. 4.curl -s "https://crt.sh/?q=example.com&output=json" | python3 -m json.tool
  5. 5.# Look for certificates you did not request
  6. 6.# Note the certificate serial number and SHA-256 fingerprint
  7. 7.`
  8. 8.Request immediate revocation from the CA:
  9. 9.- Contact the CA's security team immediately
  10. 10.- Provide the certificate serial number and evidence of misissuance
  11. 11.- Request revocation with reason code keyCompromise or affiliationChanged
  12. 12.- The CA will add the certificate to the CRL and update OCSP responders
  13. 13.Verify the certificate has been revoked:
  14. 14.```bash
  15. 15.# Check OCSP status
  16. 16.openssl ocsp -issuer intermediate.pem -cert fraudulent.pem \
  17. 17.-url http://ocsp.ca.com -resp_text | grep "Certificate Status"
  18. 18.# Should show: Certificate Status: revoked

# Check CRL openssl crl -in crl.pem -text -noout | grep -A2 "Serial Number" ```

  1. 1.Reissue your legitimate certificates:
  2. 2.```bash
  3. 3.# Generate a new key pair (do not reuse the old key)
  4. 4.openssl req -new -newkey rsa:2048 -nodes \
  5. 5.-keyout example.com.new.key \
  6. 6.-out example.com.new.csr \
  7. 7.-subj "/CN=example.com" \
  8. 8.-addext "subjectAltName=DNS:example.com,DNS:www.example.com"

# Submit CSR to CA for reissuance # Or use Let's Encrypt: sudo certbot certonly --force-renewal -d example.com -d www.example.com ```

  1. 1.Deploy the new certificate and verify:
  2. 2.```bash
  3. 3.sudo cp example.com.new.crt /etc/nginx/ssl/example.com.crt
  4. 4.sudo cp example.com.new.key /etc/nginx/ssl/example.com.key
  5. 5.sudo systemctl reload nginx
  6. 6.# Verify the new certificate is active
  7. 7.openssl s_client -connect example.com:443 </dev/null 2>/dev/null | \
  8. 8.openssl x509 -noout -serial -subject
  9. 9.`
  10. 10.Strengthen domain validation controls:
  11. 11.```bash
  12. 12.# Add CAA records to restrict which CAs can issue for your domain
  13. 13.dig example.com CAA +short
  14. 14.# Add in DNS:
  15. 15.# example.com. CAA 0 issue "letsencrypt.org"
  16. 16.# example.com. CAA 0 issue "digicert.com"
  17. 17.# example.com. CAA 0 iodef "mailto:security@example.com"
  18. 18.`

Prevention

  • Monitor Certificate Transparency logs for unauthorized certificates using certwatch or similar tools
  • Implement CAA records to restrict which CAs can issue certificates for your domains
  • Use domain validation methods you control (DNS-01 challenge preferred over HTTP-01 or email)
  • Enroll in CA notification programs that alert you when certificates are issued for your domains
  • Use Certificate Transparency monitoring services (Facebook CT, Google CT) for real-time alerts
  • Conduct periodic audits of all active certificates for your domains