SSL.com: DCV bypass and issue fake certificates for any MX hostname

April 19, 2025 · Mozilla Bugzilla

URL: https://bugzilla.mozilla.org/show_bug.cgi?id=1961406

“SSL.com failed to conduct accurate domain validation control when utilizing the BR 3.2.2.4.14 DCV method (Email to DNS TXT Contact).”

SSL.com issued a certificate for aliyun.com to someone who only had an email address there. The same bug hit a second validation method and produced 11 bad certificates. SSL.com disabled the method within hours. Every browser trusted those certificates.