A CA/Browser Forum, serving as a platform for collaborative decision-making considering the interests of browser vendors and certificate authorities, has approved new requirements for organizations issuing certificates for HTTPS. The new requirements declare 11 methods of domain ownership verification, for which the certificate is issued, to be obsolete. The discontinuation of support for these obsolete methods will occur in phases until March 2028. The reasons for discontinuing support include a focus on automatically performed and cryptographically verifiable verification methods.
The obsolete methods include those related to the use of information from the WHOIS service, confirming contact details via email, phone calls, faxes, SMS, or paper letters, as well as verification based on checking ownership of the IP address listed for the domain in DNS. It is expected that the discontinuation of support for these verification methods will eliminate loopholes that potentially allow attackers to obtain a certificate for a domain, which they do not control. For instance, a year ago, the ability to obtain TLS certificates for foreign domains in the '.mobi' zone was demonstrated by capturing the outdated WHOIS service of the registrar for this domain zone.
The list of domain ownership verification methods declared obsolete:
- Sending an Email, fax, SMS, or paper letter to the contact details specified for the domain in the WHOIS database or in the SOA record in DNS.
- Sending an Email, fax, SMS, or paper letter to the contact details specified for the domain-related IP address.
- Sending a verification code to standard Emails, such as admin@, administrator@, webmaster@, hostmaster@, and postmaster@.
- Sending a verification code to the Email specified in the domain's CAA record in DNS.
- Sending a verification code to the Email specified in the domain's TXT record in DNS.
- Confirmation by phone call to the number listed as the contact for the domain.
- Confirmation by phone call to the number specified in the domain's TXT record in DNS.
- Confirmation by phone call to the number specified in the domain's CAA record in DNS.
- Confirmation by phone call to the number listed as the contact for the IP address to which the domain is linked.
- IP-cím ellenőrzések, amely a DNS-ben már bejegyzett domainhez tartozik.
- IP-cím visszafelé történő feloldásán alapuló ellenőrzések.
Forrás: opennet.ru
