4 ms·
thats not the point OP was trying to make, the cert is issued via control of the domain, get control of the domain somehow, most any CA will happily issue you a
by throwaway2048 11y ago
thats not the point OP was trying to make, the cert is issued via control of the domain, get control of the domain somehow, most any CA will happily issue you a cert for it.
- tptacek 11y agoGo try to get a domain-validated cert for Google. They are in no way relying on DNSSEC.
- throwaway2048 11y agoThat's great, if you are Google. I unfortunately, am not Google.
- markdown 11y agoYou are not Google. How many people are potentially affected if the security of your domain were to be compromised?
- xorcist 11y agoI suppose that's easy bordering on trivial for an attacker of sufficient skill. At least it used to be. Is that no longer the case? If there is a blacklist in place, absolutely each and every one of the hundreds of CAs need to adhere to it. One mistake or one exception and I could still get a misissued certificate just as easily as ten years ago. Google can probably get it revoked very quickly, but we all know how well that works in practice. The only saving grace for the CA system is key pinning, and that's the only reason all those corrupt and/or incompentent CAs were exposed lately. But key pinning is not enough in itself. It is complementary to your certificate validation path(s).
- snowwrestler 11y agoNot all certs, though, right? I believe extended validation certs require more documentation than just domain control.