A vulnerability in the SSL.com certificate authority allowed obtaining a certificate for someone else's domain
A vulnerability has been identified in the domain ownership verification system at the SSL.com certification authority, allowing attackers to obtain a TLS certificate for any domain by providing an email address controlled by the attacker. Gaining access to an email associated with the target domain was sufficient to acquire a TLS certificate. For example, the vulnerability allowed the issuance of TLS certificates for domains used in public email services such as gmail.com, yandex.ru, yahoo.com, outlook.com, and icloud.com. The vulnerability also provided attackers with the ability to […]
