Yeah this should be revoked. Mozilla's CA acceptance programs mandate that the CA revokes the cert if the key gets compromised, and I presume others do too.
> If you have a test domain you can stick it on CloudFlare and get a certificate for free without the private part becoming public.
It all comes down to the fact that CA's don't want you to sign your own certificates, even when it's one of your subdomains unless you pay the big bucks.
Best thing to do it still to create your own CA and sign certs for these kinds of things since it's meant for testing and development anyway. It's not that hard, anyone can use some command line can do it.
I'm surprised there's no "CA-tool-as-a-service" where the CA provides an API (and maybe a CLI tool that uses that API) allowing you to automatically request-and-generate certs from their CA server provided it's for a subdomain of a domain you have on your account.
This would be for subdomains with their own "sovereignty"; e.g. Tumblr or Wordpress blogs, where the subdomain "owner" could conceivably want to issue their own subdomains, or, heaven forbid, do client-cert signing for their subdomain.
The CA SHALL revoke a Certificate within 24 hours
if one or more of the following occurs:
(...)
3. The CA obtains evidence that the Subscriber’s
Private Key corresponding to the Public Key in the
Certificate suffered a Key Compromise or no longer
complies with the requirements of Appendix A;
4.9.1 Circumstances for Revocation
Comodo may revoke a digital Certificate if any of the following occur:
A personal identification number, Private Key or password has, or is likely to become known to someone not authorized to use it, or is being or is likely to be used in an unauthorized way
I was actually looking at the comodo website to figure out if I can submit revokation on my own (we've got the key after all...). Gave up after looking at 20+ pages. Apart from a login site for email cert revocation, I can't find any reasonable contact.
Comodo website is not that good apparently.
Edit: in the document posted by brohee: (about authentication for certs revocation) "OR the Subscriber
must be able to send an S/MIME email signed with the private key associated with the Certificate". That's doable :)
4.9.2 Who can Request Revocation
A Subscriber or another appropriately authorized party
can request revocation of a Certificate. An authorized party includes an RA, regardless of whether on behalf of the
Subscriber may request revocation through their account.
Other parties may report suspected Private Key
Compromise, Certificate misuse, or other types of fraud, compromise, misuse, inappropriate conduct, or any other matter related to Certificates, in the first instance, by email to sslabuse@comodo.com.
Mozilla should probably add 'charging for revocation' to their list of problematic practices (required to be included in Firefox). Not that revocating compromised certificates isn't already required, but just that some behavior by poor CAs needs to be explicitly pointed out: https://wiki.mozilla.org/CA:Problematic_Practices
Good question. Maybe you can skip the fee by posting your private key to pastebin and send them the link? :P Might not leave you with an account in good standing with them though ;)
Why? If I own a domain, then declare that "administrators of this domain include: everyone.", then how is the cert invalidly issued?
BTW we love CloudFlare. But the DNS limitations (no wildcards for SSL without $$$$/month, only top-level subdomains allowed) really hurt for developing things. The wildcard bit I understand (valuable service), the multi-level hostnames I don't get; sounds like some technical issue? I know you just get a wildcard for the root, but even paid I've been told there's no workaround. So I can't do [stuff].test.example.com.
Annoyingly, TLS wildcards have very a different meaning to DNS wildcards.
DNS wildcards only work when * is the leftmost label of a domain name, so
*.example.com is a wildcard
foo.*.example.com is not a wildcard
*bar.example.com is not a wildcard
A DNS wildcard matches any non-zero number of labels, so
*.example.com
foo.example.com matches
foo.bar.example.com matches
example.com does not match
RFC 4592 describes DNS wildcards.
Unlike the DNS, the * in a TLS certificate can only match one label, so
*.example.com
foo.example.com matches
foo.bar.example.com does NOT match
example.com does not match
RFC 2818 also allows the * to appear within a domain name, not just as the leftmost label, and wildcards work even when they are part of a label. One of its examples says
f*.com
foo.com matches
bar.com does not match
But nowadays sub-label wildcards like this are not supported.
Right, but even in paid plans, there's no ability to get further subdomains. Just pointing that out and wondering why. Technical issue that isn't worth the effort?
You do? Last I checked, I just saw that you had the option to put a self-signed cert on your own server, but no way to tell CloudFlare to validate it (e.g.: I couldn't upload my public cert to CF and say "this is what you should expect"). Alternatively, I could buy my own valid cert and put it on the server. Is the option to get a valid signed cert from CF new?
Cloudflare has a few options you can choose from for cloudflare<=>origin connections. I've tried them all out and they've worked as advertised as far as I could tell:
I set up Cloudflare with their "Strict" SSL option, which requires that my origin servers use a valid TLS certificate. I paid the CA toll to get a cert for my site, and I use that cert to serve connections from Cloudflare's servers.
They also have a "Full" option, which allows you to use a self-signed cert (with no validation -- you might be able to require validation of self-signed certs if you're on a paid plan) on your origin servers, which is slightly more secure than the "Flexible" option, which uses HTTP (with no encryption) when connecting to the origin server, even though it then serves the content to end users over HTTPS with their own (valid) cert.
Wonder how long before COMODO revokes this cert?
If you have a test domain you can stick it on CloudFlare and get a certificate for free without the private part becoming public.