On 07/19/2017 06:03 PM, Tom wrote:
Following that discovery, I've search for odd (invalid?) DNS names.
Here is the list of certificated I've found, it may overlap some discovery already reported. If I'm correct, theses certificate are not revoked, not expired, and probably trusted by Mozilla (crt.sh issuer are marked trusted by Mozilla, but not all).

Annotating these certs:

Starting with *:

I believe this cert is presently untrusted by Mozilla due to revocation of all paths to the Federal PKI:
https://crt.sh/?id=7211484    *eis.aetc.af.mil

chains to StartCom (and all of these from StartCom are minor compared to StartCom's other problems):
https://crt.sh/?id=10714112    *g10.net-lab.net

chains to Baltimore CyberTrust Root (DigiCert):
https://crt.sh/?id=48682944    *nuvolaitaliana.it

chains to StartCom:
https://crt.sh/?id=15736178    *assets.blog.cn.net.ru
https://crt.sh/?id=17295812    *dev02.calendar42.com
https://crt.sh/?id=15881220    *dev.1septem.ru
https://crt.sh/?id=15655700    *assets.blog.cn.net.ru
https://crt.sh/?id=17792808    *quickbuild.raptorengineering.io

Starting with -:

chains to QuoVadis:
https://crt.sh/?id=54285413 -d1-datacentre-12g-console-2.its.deakin.edu.au

chains to StartCom:
https://crt.sh/?id=78248795    -1ccenter.777chao.com

Multiple *.:

chains to QuoVadis:
https://crt.sh/?id=13299376    *.*.victoria.ac.nz

I believe this cert is presently trusted by Mozilla only via a technically constrained subCA:
https://crt.sh/?id=44997156    *.*.rnd.unicredit.it

chains to Swisscom:
https://crt.sh/?id=5982951    *.*.int.swisscom.ch

Internals TLD:

chains to Baltimore CyberTrust Root (DigiCert):
https://crt.sh/?id=33626750    a1.verizon.test

I believe this cert is presently untrusted by Mozilla due to revocation of the relevant subCA:
https://crt.sh/?id=33123653    DAC38997VPN2001A.trmk.corp

chains to Certplus (DocuSign):
https://crt.sh/?id=42475510    naccez.us.areva.corp

I believe these presently lack an unrevoked, unexpired trust path in Mozilla:
https://crt.sh/?id=10621703    collaboration.intra.airbusds.corp
https://crt.sh/?id=48726306    zdeasaotn01.dsmain.ds.corp
dev-security-policy mailing list

Reply via email to