3 ms·
To clarify, Let's Encrypt validates identity by trusting DNS resolution of a domain and then trusting a TCP/IP connection to the IP, correct? It's good to encr
by anfedorov 10y ago
To clarify, Let's Encrypt validates identity by trusting DNS resolution of a domain and then trusting a TCP/IP connection to the IP, correct?
It's good to encrypt things, but I wouldn't be too surprised if it were possible for folks to issue bad certs via them, as well.
- tokenizerrr 10y agoYes, this is called domain validation and most CAs operate like this for regular non-EV certificates. Sometimes it's an email, sometimes it's a file with certain content at a certain URL, sometimes it's a DNS record. But beyond that, no further validation is required for regular certificates.
- AndyMcConachie 10y agoI don't know why you were down voted. Yes, Let's Encrypt does verification by requiring a site to host a string on port 80. They discover the site via DNS, and they do NOT require DNSSEC. Thus you can absolutely trick Let's Encrypt into issuing a bad cert if you can serve them bad DNS responses. This OCR issue with Comodo in TFA concerns WHOIS data, which may or may not be more reliable than unsigned DNS data. Regardless your point remains valid.
- tokenizerrr 10y agoYou can also trick practically every other CA using the same techniques.
- AndyMcConachie 10y agoYes. And remember you only have to trick one of them for them all to be useless :)
- deleted 10y ago[deleted]