4 ms·
I don't see why you couldn't do the HTTP validation, but over the existing HTTPS cert you have, without having to accept non-TLS connections. To be honest, I j
by BillinghamJ 9y ago
I don't see why you couldn't do the HTTP validation, but over the existing HTTPS cert you have, without having to accept non-TLS connections.
To be honest, I just don't think the SNI challenge has any place here. Although I totally recognise it is an easier option where you're more restricted, the fundamental security concerns are more important.
- tonyarkles 9y agoYour sibling comment suggests that the LetsEncrypt verifier would potentially follow a redirect HTTPS, which I'm going to have to experiment with today because it'd keep things simpler here. Best I know, currently HTTP validation is required to happen on port 80. And that works awesome for bootstrapping; on a new install, you don't need to provision a fake self-signed cert to be able to request a real one. If it can happen over HTTP or HTTPS, that would be amazing.
- BillinghamJ 9y agoIt seems... very strange that it doesn't allow the use of port 443/HTTPS with a self-signed cert. It's exactly the same thing.