3 ms·

> I did expect that each request includes a fresh verification of the domain control. And I also expect that substantial majority of people out there believe in

by pfg 10y ago

> I did expect that each request includes a fresh verification of the domain control. And I also expect that substantial majority of people out there believe in this process / data flow as that’s how certificates have always been verified – for each new certificate, you either have to send an email from a given domain or put a file to a web server’s folder. This is not correct. Certificate Authorities are allowed to reuse authorizations for (I believe) up to 36 months, so Let's Encrypt is already significantly below that (with 90 days right now, and probably closer to something like ~7 days soon). Many CAs I've used in the past worked like this.

0x0 10y ago
This is interesting in the context of buying and selling domain names. Let's say you pay big $$$ for a fancy .com because you're launching a new product with that name or whatever. The seller could actually possess certificates (or authorizations) that allow them to MITM your fancy expensive domain for up to, what, 3 years. Never really thought of that. CT logs could prove on the date of purchase that your new domain no longer has any valid certificates in the hands of third parties, but if the third party still holds an authorization, they could sneakily obtain new certificates long after the sale? Or - are authorizations also logged somehow to CT-like logs?
- pfg 10y ago
  Yeah, it's definitely something I'm hoping the CA/B Forum will address at some point. Something like a month seems like a sweet spot between not being annoying for new customers when they're in the process of getting multiple certs and not being a huge deal when domains are transferred. I'm not aware of any kind of "Authorization Transparency" effort. Let's Encrypt were thinking about a way to share logs at some point (IIRC), so it might get included in those, but that's a maybe for the future and not a general solution for all CAs.

by pfg 10y ago

0x0 10y ago

This is interesting in the context of buying and selling domain names. Let's say you pay big $$$ for a fancy .com because you're launching a new product with that name or whatever. The seller could actually possess certificates (or authorizations) that allow them to MITM your fancy expensive domain for up to, what, 3 years. Never really thought of that. CT logs could prove on the date of purchase that your new domain no longer has any valid certificates in the hands of third parties, but if the third party still holds an authorization, they could sneakily obtain new certificates long after the sale? Or - are authorizations also logged somehow to CT-like logs?

pfg 10y ago
Yeah, it's definitely something I'm hoping the CA/B Forum will address at some point. Something like a month seems like a sweet spot between not being annoying for new customers when they're in the process of getting multiple certs and not being a huge deal when domains are transferred. I'm not aware of any kind of "Authorization Transparency" effort. Let's Encrypt were thinking about a way to share logs at some point (IIRC), so it might get included in those, but that's a maybe for the future and not a general solution for all CAs.