Update: CAs Still Accepting E-mail as Proof of Domain Ownership

Carnegie Mellon CERT warns that many certificate authorities still issue domain-validated SSL/TLS certificates based only on control of certain email addresses (such as admin@, hostmaster@), which could allow attackers who register or hijack those addresses to obtain valid certificates and spoof HTTPS traffic; impacted CAs include COMODO, Entrust, GeoTrust, GlobalSign, and GoDaddy, and CERT recommends restricting creation of commonly accepted role addresses though a comprehensive fix requires CA policy changes.