On: 'Trivially easy' to buy SSL certificate for domain you don't own

[grepular]

They tend to have a list of addresses that the certificate can be sent to, eg:

postmaster@domain webmaster@domain ssladmin@domain

If you can get access to ssladmin@gmail.com, then you can probably register an SSL cert for gmail.com.

[gus_massa → grepular]

The problem is that if each CA makes its own list, it is very difficult to make a secure web mail service and I hope that no Susan Sladmin is working at your organization. If I want to make a Mailinator clone, which address should I reserve?

(For example webmaster@mailinator.com is working. http://www.mailinator.com/maildir.jsp?email=webmaster)

[grepular → gus_massa]

Yes. There are hundreds of CA's and they all work differently. It's a security nightmare.