3 ms·
Doesn't LetsEncrypt require that you have DNSSEC enabled on your domain, as a first step? DV is a valid proof of identity, assuming DNSSEC, right?
by Jasper_ 11y ago
Doesn't LetsEncrypt require that you have DNSSEC enabled on your domain, as a first step? DV is a valid proof of identity, assuming DNSSEC, right?
- nly 11y agoNo, DNSSEC isn't required. LetsEncrypt supports a bunch of DV methods right now[0], but the bottom line is that if someone can control either your DNS server or your web server (any web server on an IP at which your domain points) then they can always get a certificate for your domain. This applies to all DV cert issuance from most CAs afaik. Full DNSSEC verification by the issuing CA (LetsEncrypt) still wouldn't mitigate attacks against the "Simple HTTP" method. [0]https://letsencrypt.github.io/acme-spec/#rfc.section.7 https://letsencrypt.github.io/acme-spec/#rfc.section.7