Hacker News Reader

Comment by k33l0r | Hacker News Reader

I tried using CloudFlare for my site, but they (or their CA partner) wouldn't issue a certificate for my domain (piranhas.co) because it contains the substring “iran”. Seriously[0].

[0]: https://twitter.com/matiaskorhonen/status/561063104596172800

View on HN

So 20 years later we are still stuck with this: https://en.wikipedia.org/wiki/Scunthorpe_problem ?

It's always going to be around in some form, it's a clbuttic problem.

A daily saga for anyone who is stuck administering censorship.

Unfortunately, the CAs have their policies and we must adhere to those. We're working, however, on ways to better (and automatically) communicate with them when we encounter false positives. In this particular case, yes, some have very basic string matching for keywords like "iran" -- but in these scenarios we can (and do) request them to recheck by hand.

Your particular request should have been handled in less than 24 hours (or shorter, if non-free plan). The process for some of them is more manual than we'd like, but a support request can be filed to expedite if this happens again.

- CloudFlare's PM for TLS

I had the a similar problem, they refused to issue a certificate because the domain had a trademarked word in it. Seems strange they would be the ones to enforce trademarks, but I guess it could be considered as an anti-phishing measure or something.

This is a relic of the CA/B Forum (https://cabforum.org/) delegating review of brand/trademark checks to the CAs. We (CloudFlare) send hostnames to the CA for issuance and they check against internal lists, holding up anything for manual review that may violate another's trademark or be used for phishing (e.g., "pavpal" with a 'v' rather than a 'y'), etc.

Each CA has their procedures but most look at data sources like the Alexa Top 1000, and specific requests from high value targets like Microsoft, Google, etc. In some cases, e.g., Microsoft, the CAs must actually reach out to specific contacts at those firms before they can issue. In other cases, they manually review and release to us.

Did CF follow up after that?

Seems like CF didn't respond for 24 days after the initial exchange, and they haven't responded to his final tweet either.

While we often make announcements there, Twitter isn't an official support channel. Requests should be filed at https://support.cloudflare.com where they can be tracked and responded to directly.

Nothing since then. I moved on and aren't inclined to go back to CloudFlare.

Reply on news.ycombinator.com