3 ms·
I can serve using HTTP on this domain should be enough to prove you can also serve HTTPS on this domain though. It's on the domain owner to avoid giving away c
by corobo 11y ago
I can serve using HTTP on this domain should be enough to prove you can also serve HTTPS on this domain though.
It's on the domain owner to avoid giving away control of their (sub)domain to a malicious party. Exactly the same as with regular HTTP and anything else that uses DNS.
- Ao7bei3s 11y agoIt's not about proving that you can serve HTTPS, it's about proving that you can legitimately serve HTTPS. I'd find HTTP(S)-based validation ok if CAs wouldn't issue certificates with an expiration time past the expiration time of the DNS records. Of course that would be fairly impractical. But then DNS-based validation exists and doesn't have these problems.
- eridius 11y agoWhat is the difference between serving HTTPS and "legitimately" serving HTTPS? Or to put it another way, what qualifies as "illegitimate" HTTPS?