4 ms·
> And to install a specially formed page on the site, you still need to be able to GET a copy of that page to install in the first place, and how the hell are y
by pfg 9y ago
> And to install a specially formed page on the site, you still need to be able to GET a copy of that page to install in the first place, and how the hell are you going to do that without ALSO stealing their CA login credentials, which I'm pretty damn sure will NOT be stored on every single random server you hack?
The ability to answer arbitrary HTTP requests on a server is sufficient to get a publicly-trusted certificate from any number of CAs. You do not need the credentials for the CA they've been using. Just create a new account. Future extensions for the DNS CAA record[1] might be able to help against this if you keep your credentials away from your web server.
[1]: https://datatracker.ietf.org/doc/html/draft-ietf-acme-caa https://datatracker.ietf.org/doc/html/draft-ietf-acme-caa
- wfunction 9y ago> The ability to answer arbitrary HTTP requests on a server is sufficient to get a publicly-trusted certificate from any number of CAs. I'm saying you have to know what response to GIVE, don't you? You can't just give a random response...
- problems 9y agoThe CA tells you what response to give on that new account you signed up.
- wfunction 9y agoThanks, that didn't occur to me since I was mostly thinking of EV certs for some reason.
- pfg 9y agoThere's nothing to stop you from creating a new account at the CA of your choice, asking for a validation token, and putting it wherever it needs to be.