5 ms·
I believe cheap Comodo SSL certs are domain based and subject to DNS hijack aren't they? If so they shouldn't be considered all that secure for websites that h
by dsmithatx 11y ago
I believe cheap Comodo SSL certs are domain based and subject to DNS hijack aren't they? If so they shouldn't be considered all that secure for websites that have customers and need to be secure.
- geofft 11y agoThe CA system, for better or worse, doesn't work that way. Even if your cert is not from a domain-validating CA, that doesn't prevent the attacker from getting a cert from them. And I'd bet that pretty much all root CAs are domain-validating these days. If by "DNS hijacking" you mean seizing control over the account with the registrar to change the delegation, or the legitimate DNS servers, I don't think there's a strong reason to worry about that more than someone seizing control of your account with your SSL provider, or your webserver, respectively. (It's possible to secure the former two at least as strongly as the latter two.) If by "DNS hijacking" you mean attacks on the unauthenticated DNS protocol, CAs are sort of supposed to query DNS from multiple locations to defeat that, although I don't think there's a strong rule about this. I'm not sure what Comodo's and Let's Encrypt's specific practices are.