0

I've recently acquired a SSL certificate from a certificate authority called GlobalSign nv-sa. The certificate is already in use. What I am curious to know is what happens if I change major parts of the source code of my website. So let's say I implement a pishing form to collect user's usernames and passwords. Will the CA ever check if my lovely website turned into a malicious, sensitive data fishing site? Will they then immediately revoke the certificate?

6
  • What type of SSL certificate do you have? Different types have different levels of verification. Is your certificate DV (domain validation), OV (organization validation), or EV (extended validation)? – Stephen Ostermiller Jan 20 at 20:37
  • A certificate proves identity, nothing else. But §9.6.3 of CAB Forum requirements do say: "the CA is entitled to revoke the certificate immediately .. or if the CA discovers that the Certificate is being used to enable criminal activities such as phishing attacks, fraud, or the distribution of malware." I doubt they really enforce that... – Patrick Mevzek Jan 20 at 20:42
  • Thank you both. I just saw the certificate is DV, which means this proves that the domain holder is valid? – enne87 Jan 20 at 21:31
  • 1
    DV certs are issued to anybody that can prove they have control over the domain. No checking needs to be done against the identity of the person or organization obtaining the certificate. They are the most basic (and most widely issued) type of certificate. – Stephen Ostermiller Jan 21 at 1:20
  • @Stephen Ostermiller: Alright, I thought that Let's Encrypt certificates are the most basic. But I think you mean certificates that are issued by a CA. – enne87 Jan 21 at 9:27
4

CA's do not regularly check their customers websites, so they will likely not check if your site has turned malicious. The point of a Certificate is to give the end user comfort that the site they are dealing with is not being intercepted en-route, and - for EV certs - gives some assurances that the people behind the certificate are who they say they are.

If it is brought to their attention that your site is being used for phishing then Globalsign has the right to revoke your certificate. This is buried in section 4.10 of their Global Subscriber Agreement at https://www.globalsign.com/en/repository/GlobalSign_Subscriber_Agreement.pdf (also 4.6 -

In practical terms its unlikely your certificate will be revoked without warning, although they are legally entitled to do so.

2

The CA didn't check your website before issuing the certificate in the first place: it's their job to check the control of the domain for domain validated DV certificates and the identity of the owner for extended validation EV certificates. It's not their responsibility to validate the contents – nor even that they could given the amount of possible pages and dynamic content. (Not to even mention all the other use cases for certificates than HTTPS.)

Therefore, malicious actors can acquire valid certificates, too. Such occasions might get addressed retrospectively, but never by default nor beforehand, and the sites aren't checked regularly, either. The padlock isn't a sign of a trustworthy site, but of a secured connection!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.