4 ms·

letsencrypt is great and I use it. But I don't really get it. All I needed to do was prove that I could place a generated file on the server that I wanted the c

letsencrypt is great and I use it. But I don't really get it. All I needed to do was prove that I could place a generated file on the server that I wanted the certificate for. This seems to me to be a very low bar. What am I missing?

codebeaker 9y ago
They're not verifying your identity, just that you control the hardware running the domain that you want to generate a certificate for.
- peterwwillis 9y ago
  Correction: that you can control the IP space advertised to Let's Encrypt. A BGP exploit would result in getting valid certs for someone else's domain/host. It's almost trivial to exploit BGP, which is why PKI is so important... so it should actually be incredibly difficult to get a cert.
  - discreditable 9y ago
    If someone is hijacking BGP to MITM the world, how are the old methods any better?
    - snuxoll 9y ago
      If you could hijack BGP you could just as easily inject routes to intercept DNS requests as well.
      - walrus01 9y ago
        This is why ISPs use tools like RPKI validation of received routes, and things like the ARIN, RADB and RIPE route-servers.
        icedchai 9y ago
        Almost nobody uses RPKI: https://rpki-monitor.antd.nist.gov/ https://rpki-monitor.antd.nist.gov/
vsund 9y ago
There's a difference in certificate type. Let's encrypt (which only issues basic certificates) just verifies that you're the rightful owner of a domain, not whether the domain is what it says. If you'd like to have more verification for your certificate you need a extended validation certificate (which often costs money). These certificates also include your (company) name and the issuer verifies whether it's correct or not. Basic certificate issuers don't judge over domain names or content, they just verify domain ownership.
- pfg 9y ago
  To clarify, other certificate types do not judge content either. The difference is that they verify your organisational details (to a varying degree, depending on the validation level) and include them in the certificate. The CA is not going to check whether the business is fraudulent or anything like that.
- walrus01 9y ago
  To clarify for people who've never bought one, an EV SSL cert actually involves work by humans at the CA. They do things like obtain copies of your state/provincial corporate registration, business license, LLC registration, local business license, etc. Then the do basic matching that your physical business address of record matches with what your state's Secretary of State has on file for your corporation. It's about a half hour process on the part of the CA of verifying the existence of a real business entity.
Diederich 9y ago
The bar for basic certs has been, for some time, an indication of control over the DNS domain in question. In the past, the bar used to be much higher. Whether a lower bar is a good idea or not I will leave to other more informed folk.
- cortesoft 9y ago
  When was it higher, and what made it higher? The only extra thing that you used to have to do is pay money....
jnbiche 9y ago
They're not verifying your identity since it's a domain validated cert. The point is just to ensure that communications between a user's browsers an www.somerandomdomain.com are secure, regardless of who is behind the domain in question. For identify validation, you'd need to buy an EV or OV cert. But for most organizations, particularly if your domain IS your identity, a domain-validated cert is absolutely fine.
walrus01 9y ago
That is basically the bar for a "DV" (domain validated) SSL cert. Let's say you are the owner of the domain rupertsdildoemporium.com and want to get an SSL cert. Since you own the domain you control the entries for what nameservers it uses. Since you control the nameservers, you can point the A record for the domain anywhere of your choosing. Or put an arbitrary TXT record in the DNS zonefile. That is the full extent of what you need to prove to get a domain validated SSL cert. It is complete and total bullshit that DV SSL certs still cost money (thanks LetsEncrypt), anywhere from $9/year to $80/year. The companies that rely on selling DV validated SSL certs for their business model are polishing the brass doorknobs on the Titanic. It's all going down. Just a question of when.

codebeaker 9y ago

They're not verifying your identity, just that you control the hardware running the domain that you want to generate a certificate for.

peterwwillis 9y ago
Correction: that you can control the IP space advertised to Let's Encrypt. A BGP exploit would result in getting valid certs for someone else's domain/host. It's almost trivial to exploit BGP, which is why PKI is so important... so it should actually be incredibly difficult to get a cert.
- discreditable 9y ago
  If someone is hijacking BGP to MITM the world, how are the old methods any better?
  - snuxoll 9y ago
    If you could hijack BGP you could just as easily inject routes to intercept DNS requests as well.
    - walrus01 9y ago
      This is why ISPs use tools like RPKI validation of received routes, and things like the ARIN, RADB and RIPE route-servers.
      - icedchai 9y ago
        Almost nobody uses RPKI: https://rpki-monitor.antd.nist.gov/ https://rpki-monitor.antd.nist.gov/

vsund 9y ago

There's a difference in certificate type. Let's encrypt (which only issues basic certificates) just verifies that you're the rightful owner of a domain, not whether the domain is what it says. If you'd like to have more verification for your certificate you need a extended validation certificate (which often costs money). These certificates also include your (company) name and the issuer verifies whether it's correct or not. Basic certificate issuers don't judge over domain names or content, they just verify domain ownership.

pfg 9y ago
To clarify, other certificate types do not judge content either. The difference is that they verify your organisational details (to a varying degree, depending on the validation level) and include them in the certificate. The CA is not going to check whether the business is fraudulent or anything like that.
walrus01 9y ago
To clarify for people who've never bought one, an EV SSL cert actually involves work by humans at the CA. They do things like obtain copies of your state/provincial corporate registration, business license, LLC registration, local business license, etc. Then the do basic matching that your physical business address of record matches with what your state's Secretary of State has on file for your corporation. It's about a half hour process on the part of the CA of verifying the existence of a real business entity.

Diederich 9y ago

The bar for basic certs has been, for some time, an indication of control over the DNS domain in question. In the past, the bar used to be much higher. Whether a lower bar is a good idea or not I will leave to other more informed folk.

cortesoft 9y ago
When was it higher, and what made it higher? The only extra thing that you used to have to do is pay money....

jnbiche 9y ago

They're not verifying your identity since it's a domain validated cert. The point is just to ensure that communications between a user's browsers an www.somerandomdomain.com are secure, regardless of who is behind the domain in question. For identify validation, you'd need to buy an EV or OV cert. But for most organizations, particularly if your domain IS your identity, a domain-validated cert is absolutely fine.

walrus01 9y ago

That is basically the bar for a "DV" (domain validated) SSL cert. Let's say you are the owner of the domain rupertsdildoemporium.com and want to get an SSL cert. Since you own the domain you control the entries for what nameservers it uses. Since you control the nameservers, you can point the A record for the domain anywhere of your choosing. Or put an arbitrary TXT record in the DNS zonefile. That is the full extent of what you need to prove to get a domain validated SSL cert. It is complete and total bullshit that DV SSL certs still cost money (thanks LetsEncrypt), anywhere from $9/year to $80/year. The companies that rely on selling DV validated SSL certs for their business model are polishing the brass doorknobs on the Titanic. It's all going down. Just a question of when.