3 ms·
Control over a nonstandard port on a server doesn't necessarily mean that you control the web server on :80 and :443 of that host. For example, a nonprivileged
by jdiez17 11y ago
Control over a nonstandard port on a server doesn't necessarily mean that you control the web server on :80 and :443 of that host. For example, a nonprivileged user can listen on :8443 and get a cert.
- Sir_Cmpwn 11y agoWell, there are ports that require root to bind to that aren't 80 or 443. That being said, I guess it's relevant here that Let's Encrypt only supports certs for HTTP use cases.
- detaro 11y agoWhich leaves the question which one to occupy instead. There was the suggestion on the mailing list of officially getting an acme-port reserved, but I don't remember if there was any follow-up.
- hlandau 11y agoThe problem is not all systems are *nix. Windows doesn't enforce the <1024 port restriction. The advantage of using port 443 I suppose is that it's so commonly used it'll probably (maybe) be tied up with one service or another when it comes to any important host. I guess. But really it's all guesswork and hope when it comes to deciding how to validate host control.
- jimktrains2 11y agoAnything under 1024 requires root iirc. 81, 88, &c would show you have control of the server, correct? The bigger issue is probably firewalls (in front of the server getting a cert) only allowing inbound on 80 and 443.