CYPHERLOCK, INC.

DigiCert Set to Annul Thousands of Certificates Due to DNS Verification Flaw

DigiCert, a leading certificate authority, is set to invalidate thousands of SSL/TLS certificates due to an issue with Domain Control Verification. This development may impact numerous websites.

The error originated from a flaw in the DNS-based validation procedure, affecting roughly 0.4% of domain checks. The problem arose because DigiCert omitted an underscore prefix in the random string used for CNAME-based domain validation.

Although the error seems minor, it breaches the stringent regulations established by the CA/Browser Forum (CABF) for proper domain verification.

According to the CABF Baseline Requirements, when DNS CNAME records are employed for domain validation, the random string must begin with an underscore in specific instances. This rule prevents potential conflicts between the validation subdomain and actual domain names, even though such conflicts are highly unlikely.

DigiCert has informed the affected clients, who are required to replace their certificates within 24 hours. This swift action is necessitated by CABF regulations, which stipulate that non-compliant certificates must be revoked within a 24-hour window upon discovery.

DigiCert stated, “The CABF views any issues with domain validation as critical, necessitating immediate rectification. Failure to adhere to these standards could undermine trust in the Certificate Authority. Consequently, we must revoke all compromised certificates within 24 hours of detection, without exceptions. We regret any inconvenience this may cause and are ready to support you in validating your domain and issuing replacement certificates promptly.”

Customers affected by this issue are instructed to:

  1. Access their DigiCert CertCentral account.
  2. Locate the compromised certificates.
  3. Reissue or rekey the affected certificates.
  4. Complete any additional validation requirements.
  5. Install the newly issued SSL/TLS certificates.

DigiCert traced the root of the problem to modifications made in their domain validation systems back in August 2019. The company’s system upgrade inadvertently eliminated a critical validation step, which went unnoticed due to constraints in their regression testing procedures.

To check for certificate revocation, you can use the following methods:

  • Certutil Command-Line Tool: Available on Windows, this utility can verify certificates and Certificate Revocation Lists (CRLs). Use the command:
  certutil -f -urlfetch -verify mycertificatefile.cer
  • OCSP Request: Utilize a tool like OpenSSL to send an Online Certificate Status Protocol (OCSP) request to the URL provided in the previous step:
  openssl ocsp -issuer issuer.crt -cert cert.crt -url <OCSP_URL>

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day