4 ms·
> Maybe the solution here is to make the domain name sent by the SNI challenge a subdomain of the domain being validated? FWIW, Matthew Hardeman just made an e
by Ajedi32 9y ago
> Maybe the solution here is to make the domain name sent by the SNI challenge a subdomain of the domain being validated?
FWIW, Matthew Hardeman just made an excelent post on the mozilla.dev.security.policy which discusses this solution and some potential problems with it in detail: https://groups.google.com/d/msg/mozilla.dev.security.policy/RHsIInIjJA0/rS50Pft4AQAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/...
- ploxiln 9y agoThis is an interesting detail from Ryan Sleevi > So I don't think this buys any improvement over the status quo, and actually makes it considerably more complex and failure prone, due to the cross-sectional lookups, versus the fact that .invalid is a reserved TLD. So it should be more likely for shared hosting services to recognize that .invalid is an explicitly reserved TLD, vs correctly walking subdomains and recognizing "effective TLDs" (which vary in number of dot-separated elements).
- mdhardeman 9y agoIndeed that the hosting providers do neither is a strong sign that both TLS-SNI-01 and TLS-SNI-02 and the mechanism I proposed would all be deficient to really address the issue of making this mechanism secure again.
- ploxiln 9y agoAgreed. It may be necessary to abandon TLS-SNI. Maybe ALPN will work out.