Hacker News Reader

Comment by hurutparittya | Hacker News Reader

I recently noticed that Cloudflare issued multiple, year-long certificates for one of my domains that has NOTHING to do with Cloudflare services. Trying to get them revoked has been an exercise in frustration and futility.

View on HN

Can you email me (jgc@cloudflare.com) with details? I can't see any way we'd be issuing a certificate for a domain that's got nothing to do with us. I'd like to investigate.

Wow I certainly did not expect this to catch the ears of The JGC. I shot an email, thanks!

If that is true then it is huge news. When you say "NOTHING to do with Cloudflare services" do you really mean that you have never used them as a registrar or DNS host for that domain? Have you perhaps used another provider that is reselling/whitelabeling cloudflare services?

Yes, I should have been a lot clearer before throwing out an accusation like that. What I meant to say is that to the best of my knowledge I'm not using any of their services directly. The first thing I suspected was that Porkbun, my registrar and NS provider, requested them on my behalf for some service they offer. This would still be odd, as I do not recall ever using any of their services that would require this either, and their support stated that they don't recognize the certs.

My main gripe with Cloudflare is not that they issued these certificates. It's the fact that they are valid for one(1) year and I don't have an easy, preferably automated way to have them revoked.

Looks like porkbuns DNS runs on cloudflare: https://lowendspirit.com/discussion/4602/porkbun-ns-moving-t... https://kb.porkbun.com/article/216-how-to-enable-porkbuns-cl...

So it might have been a misconfiguration on porkbuns or cloudflares (or maybe a porkbun feature that requires the cloudflare cert) end that created a cert.

Seems like porkbun should be more clear about that using "their" DNS might lead to cloudflare issuing certs for those domains.

That would be the most likely scenario, yes.

I’ve just checked my domains hosted with Porkbun and it looks similar that Cloudflare has been issuing themselves certificates for my domains.

I do trust Cloudflare and Porkbun, but it does feel a little icky to happen without /any/ feedback or being informed.

I’d at least like to see the DNS entries in the Porkbun UI!

Which CA is this? Contact their CPR endpoint and tell them you want it revoked.

Don’t bother going through Cloudflare.

If they don’t respond to you within 24 hours, let me know and we can start an incident against that CA.

That was my first instinct as well!

I reached out to Digicert at revoke@digicert.com. They responded almost immediately and directed me to Cloudflare's abuse report form, where I was met with a wall. Now I'm back to Digicert asking them to please revoke them.

Note that this isn't an urgent security situation, as the domain in question isn't in use currently. It's more of an annoyance, since the certs are valid for 1 year.

Certificates in question: https://crt.sh/?id=11447235791 https://crt.sh/?id=11447092451

This is actually very interesting. Please let me know what digicert says once you say your request again. If they push back on this I’ll escalate it with your permission.

I see the still haven’t revoked your cert. Has digicert started the revocation process?

I tried replying to the existing email thread which did not get a response. Tomorrow I'll attempt starting a new case, with a more clearly worded request. I'll let you know how that goes.

Great success. This time it went without any issues and got the certificates revoked within 6 hours of my first email.

Awesome!

Reply on news.ycombinator.com