Introduction
Certificate Authority (CA) misissuance occurs when a CA issues an SSL/TLS certificate for a domain to someone who does not control that domain. This can happen through social engineering, CA process failures, or validation bypass. The fraudulently issued certificate can be used for man-in-the-middle attacks, phishing, or impersonation. When misissuance is discovered, the certificate must be revoked immediately and all legitimate certificates may need to be reissued.
Symptoms
- Certificate Transparency (CT) log shows an unexpected certificate for your domain
- crt.sh search reveals certificates you did not request
- Browser shows a valid certificate for your domain that you did not install
- Security researcher reports unauthorized certificate issuance for your domain
- CA notifies you of a validation process breach affecting your certificates
Common Causes
- CA validation process bypassed through DNS or email control compromise
- Social engineering attack on CA staff to issue a certificate
- Automated validation vulnerability (e.g., CAA check bypass)
- Compromised domain registrar account used to pass domain validation
- CA internal process failure or misconfiguration
Step-by-Step Fix
- 1.Identify the fraudulently issued certificate:
- 2.```bash
- 3.# Search Certificate Transparency logs
- 4.curl -s "https://crt.sh/?q=example.com&output=json" | python3 -m json.tool
- 5.# Look for certificates you did not request
- 6.# Note the certificate serial number and SHA-256 fingerprint
- 7.
` - 8.Request immediate revocation from the CA:
- 9.- Contact the CA's security team immediately
- 10.- Provide the certificate serial number and evidence of misissuance
- 11.- Request revocation with reason code
keyCompromiseoraffiliationChanged - 12.- The CA will add the certificate to the CRL and update OCSP responders
- 13.Verify the certificate has been revoked:
- 14.```bash
- 15.# Check OCSP status
- 16.openssl ocsp -issuer intermediate.pem -cert fraudulent.pem \
- 17.-url http://ocsp.ca.com -resp_text | grep "Certificate Status"
- 18.# Should show: Certificate Status: revoked
# Check CRL openssl crl -in crl.pem -text -noout | grep -A2 "Serial Number" ```
- 1.Reissue your legitimate certificates:
- 2.```bash
- 3.# Generate a new key pair (do not reuse the old key)
- 4.openssl req -new -newkey rsa:2048 -nodes \
- 5.-keyout example.com.new.key \
- 6.-out example.com.new.csr \
- 7.-subj "/CN=example.com" \
- 8.-addext "subjectAltName=DNS:example.com,DNS:www.example.com"
# Submit CSR to CA for reissuance # Or use Let's Encrypt: sudo certbot certonly --force-renewal -d example.com -d www.example.com ```
- 1.Deploy the new certificate and verify:
- 2.```bash
- 3.sudo cp example.com.new.crt /etc/nginx/ssl/example.com.crt
- 4.sudo cp example.com.new.key /etc/nginx/ssl/example.com.key
- 5.sudo systemctl reload nginx
- 6.# Verify the new certificate is active
- 7.openssl s_client -connect example.com:443 </dev/null 2>/dev/null | \
- 8.openssl x509 -noout -serial -subject
- 9.
` - 10.Strengthen domain validation controls:
- 11.```bash
- 12.# Add CAA records to restrict which CAs can issue for your domain
- 13.dig example.com CAA +short
- 14.# Add in DNS:
- 15.# example.com. CAA 0 issue "letsencrypt.org"
- 16.# example.com. CAA 0 issue "digicert.com"
- 17.# example.com. CAA 0 iodef "mailto:security@example.com"
- 18.
`
Prevention
- Monitor Certificate Transparency logs for unauthorized certificates using certwatch or similar tools
- Implement CAA records to restrict which CAs can issue certificates for your domains
- Use domain validation methods you control (DNS-01 challenge preferred over HTTP-01 or email)
- Enroll in CA notification programs that alert you when certificates are issued for your domains
- Use Certificate Transparency monitoring services (Facebook CT, Google CT) for real-time alerts
- Conduct periodic audits of all active certificates for your domains