3 ms·

They have a variety of "challenges" used to prove control of the domain. They basically boil down to: - LE makes a request to example.com, to a known URL that

They have a variety of "challenges" used to prove control of the domain. They basically boil down to: - LE makes a request to example.com, to a known URL that contains a key that LE told you to put there - LE does a DNS lookup for a specific TXT record (again, containing a key they told you to put there). The complete answer to your question can be found in the ACME spec (the protocol LE uses): https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.html#rfc.section.8 https://ietf-wg-acme.github.io/acme/draft-ietf-acme-acme.htm...

theandrewbailey 9y ago
LE probably does that multiple times from a few places around the internet, to reduce the likelihood of something unexpected going on.
- j_s 9y ago
  Ain't nobody got time for that! They might have "a few places around the internet" to verify from, but I doubt it is very diverse location-wise. And there's no way they're going to bother with doing it multiple times, for free.
  - dylz 9y ago
    > they're going to bother with doing it multiple times, for free You are aware you are talking about the cost of a single HTTP GET?
    - j_s 9y ago
      > You are aware you are talking about the cost of a single HTTP GET? First, the conversation is about the possibility of multiple (not single) interactions, including protocols other than HTTP such as DNS. Perhaps you're confusing a subset of what they currently do vs. coordinating the initiation of requests multiple times from a few places around the internet (per OP) supporting multiple protocols, aggregating and verifying the responses, etc. -- all within a reasonable timeframe at scale with Internet infrastructure level high availability (while protecting against malicious misuse)? I hope this is enough to explain that no, that's not what I was talking about. But thanks for taking the time to reply!

3 ms·

They have a variety of "challenges" used to prove control of the domain. They basically boil down to: - LE makes a request to example.com, to a known URL that

by JshWright 9y ago

theandrewbailey 9y ago
LE probably does that multiple times from a few places around the internet, to reduce the likelihood of something unexpected going on.
- j_s 9y ago
  Ain't nobody got time for that! They might have "a few places around the internet" to verify from, but I doubt it is very diverse location-wise. And there's no way they're going to bother with doing it multiple times, for free.
  - dylz 9y ago
    > they're going to bother with doing it multiple times, for free You are aware you are talking about the cost of a single HTTP GET?
    - j_s 9y ago
      > You are aware you are talking about the cost of a single HTTP GET? First, the conversation is about the possibility of multiple (not single) interactions, including protocols other than HTTP such as DNS. Perhaps you're confusing a subset of what they currently do vs. coordinating the initiation of requests multiple times from a few places around the internet (per OP) supporting multiple protocols, aggregating and verifying the responses, etc. -- all within a reasonable timeframe at scale with Internet infrastructure level high availability (while protecting against malicious misuse)? I hope this is enough to explain that no, that's not what I was talking about. But thanks for taking the time to reply!