Comment on Ssl.com: DCV bypass and issue fake certificates for any MX hostnameparentComments−voxic111yYou can see the cert was revoked here https://crt.sh/?id=17926238129−progbits1yUnclear who revoked that but I think it likely was the reporter who discovered the bug. They only needed it issued & logged as evidence, and would be good practice to revoke immediately.−mcpherrinm1yThe certificate remained unrevoked in OCSP until after SSL.com acknowledged the issue, so I don’t think the reporter was the one who had it revoked.It is also possible I was being served a stale/cached OCSP response.
Comments
You can see the cert was revoked here https://crt.sh/?id=17926238129
Unclear who revoked that but I think it likely was the reporter who discovered the bug. They only needed it issued & logged as evidence, and would be good practice to revoke immediately.
The certificate remained unrevoked in OCSP until after SSL.com acknowledged the issue, so I don’t think the reporter was the one who had it revoked.
It is also possible I was being served a stale/cached OCSP response.