Google calls for halting use of WHOIS for TLS domain verifications

Google has proposed halting the use of WHOIS data for verifying domain ownership in the issuance of TLS certificates, following a security report by watchTowr that revealed vulnerabilities in the current system. TLS certificates are essential for establishing secure HTTPS connections, and the existing process allows certificate authorities (CAs) to verify domain ownership by sending an email to the address listed in the WHOIS record. However, researchers demonstrated that threat actors could exploit this process by creating a fake WHOIS server, allowing them to obtain certificates for domains they do not own. In response, Google suggested that CAs should not rely on WHOIS data for domain contact identification, with a proposed deadline of November 1, 2024, for this change. While many support the proposal, some, including representatives from Amazon, argue for an extension to April 30, 2025, due to the complexities involved in transitioning away from WHOIS. The discussion is ongoing, and formal voting on the proposed changes has yet to commence.

- Google has called for an end to using WHOIS data for TLS certificate verification due to security vulnerabilities.

- Researchers demonstrated that fake WHOIS servers could be used to fraudulently obtain TLS certificates.

- The proposed deadline for discontinuing WHOIS reliance is November 1, 2024, but some industry representatives suggest extending it to April 30, 2025.

- The CA/Browser Forum is currently discussing the proposed changes, with formal voting yet to begin.