3 ms·
How does TLS-SNI-02 fix this issue? ... Edit: I've removed most of my post here... This was already acknowledged in the article. 02 is vulnerable also.
by rgbrenner 9y ago
How does TLS-SNI-02 fix this issue?
...
Edit: I've removed most of my post here... This was already acknowledged in the article. 02 is vulnerable also.
- mdhardeman 9y agoI think the only fix is to create TLS-SNI-03 in which the only dnsName component in the self-signed certificate is a well known child of the domain label to be validated. Validating www.abc.com, SNI and dnsName is well-known-acme-pki.www.abc.com and the certificate should have some other parameter stuffed with a challenge response that is defined to be a challenge response calculated over the inputs of a random token provided to the requestor by the CA and the account key of the requestor.