4 ms·
Oh, now I understand. I wonder why Let's Encrypt/ACME servers aren't able to make the verification requests on some other port.
by Sir_Cmpwn 11y ago
Oh, now I understand. I wonder why Let's Encrypt/ACME servers aren't able to make the verification requests on some other port.
- jdiez17 11y agoControl over a nonstandard port on a server doesn't necessarily mean that you control the web server on :80 and :443 of that host. For example, a nonprivileged user can listen on :8443 and get a cert.
- Sir_Cmpwn 11y agoWell, there are ports that require root to bind to that aren't 80 or 443. That being said, I guess it's relevant here that Let's Encrypt only supports certs for HTTP use cases.
- detaro 11y agoWhich leaves the question which one to occupy instead. There was the suggestion on the mailing list of officially getting an acme-port reserved, but I don't remember if there was any follow-up.
- hlandau 11y agoThe problem is not all systems are *nix. Windows doesn't enforce the <1024 port restriction. The advantage of using port 443 I suppose is that it's so commonly used it'll probably (maybe) be tied up with one service or another when it comes to any important host. I guess. But really it's all guesswork and hope when it comes to deciding how to validate host control.
- jimktrains2 11y agoAnything under 1024 requires root iirc. 81, 88, &c would show you have control of the server, correct? The bigger issue is probably firewalls (in front of the server getting a cert) only allowing inbound on 80 and 443.
- hlandau 11y agoThere's been a lot of discussion about this on the IETF ACME mailing list. Essentially, the issue is that certificates don't nominate a specific port, so if you can get a certificate for a hostname you can impersonate any service on it. Thus, any validation method needs to represent not only a single port, but the machine as a whole. 443 is not really ideal for this purpose, but requiring control of it is probably the least worst option, security-wise.
- kuschku 11y agoHow about requiring control over DNS, like I suggested before? Put a public key in the DNS, sign the CSR with the corresponding private key, the CA will fetch DNS, verify the signature, and then sign your certificate.
- hsivonen 11y agoLE lets you get a cert by putting stuff in DNS, but it's generally hard for a program running on your Web server to modify DNS in an automated fashion and this tool focuses on what can be automated on your Web server.
- kuschku 11y agoWell, that can be automated easily, too. If I could just put a public key in DNS, sign stuff with the corresponding private key, and send the signed request via POST to LE, then they can easily check that I control the DNS, and I can automate it (and never have to change the webserver’s content or DNS).