Hacker News Reader

Are you sure that happens in practice? Unless you have an Extended Validation certificate, which verifies the company name, I'm not aware of any requirement against fraudulent uses, or precedent of certificates revoked because of that.

I know certificates must be revoked if the private key leaks (e.g. Heartbleed), but who is policing certificate use? Is there any place to send complaints? Can I email StartSSL or VeriSign and ask them to revoke faceb00k.com?

View on HN

> Can I email StartSSL or VeriSign and ask them to revoke faceb00k.com?

I think so, yes. I don't have any direct evidence to back this, but my intuition is yes, they would contact the intermediary cert issuer and request the certificate be revoked due to the fraud (assuming Verisign or StartSSL were in the trust chain of the cert).

Check out Trustico's website [0], where they say "Your domain name may be blacklisted and internet users will be wary to transact with your web site."

[0] - https://www.trustico.com/fraud/fraud.php

and what if they simply get a certificate from another source?!

Reply on news.ycombinator.com