4 ms·

Doesn't ownership of domain.tld also imply ownership of *.domain.tld?

• bracewel 11y ago
  That's the relatively simple case, but there are a number of corner cases that make the process much more complicated. See https://github.com/letsencrypt/acme-spec/pull/97 https://github.com/letsencrypt/acme-spec/pull/97 for a discussion of why this was scraped from the ACME specification proposal.
  • 0x0 11y ago
    I don't get it. Whoever controls the base domain could always just replace the NS records and point any subdomain wherever.
• the_mitsuhiko 11y ago
  I don't think the owner of "co.uk" should have the power to issue certificates for everything below it.
  • deathanatos 11y ago
    To make the original comment more precise, should not proving ownership of: <some domain> be enough to imply ownership of anything under that? i.e., DNS is a hierarchy — right? At the top level (a bit closer to how the original comment phrased it, I'd say that proving ownership of, <some domain>.<some public suffix> should prove ownership of all domains under that. To address the specific case of "co.uk", anyone in control of a public suffix[1] should just fail the check (i.e., owning a public suffix does not imply ownership of all subdomains, which I think is correct). Someone with better knowledge of the innards of DNS would have to speak to if the Public Suffix List is good enough here. Really, why can't I be a mini-CA for my own domain, with only the power to issue certs for the set of domains I actually have control over? (essentially, why can't I get a nameConstraint CA cert?) [1]: The Public Suffix list is a list of what a human might call a "tld, essentially"; "com" is a public suffix, but so is "co.uk": https://publicsuffix.org https://publicsuffix.org
    • fidget 11y ago
      Because client support isn't there for nameConstraints. I really wish it was though.