3 ms·

They're not verifying your identity, just that you control the hardware running the domain that you want to generate a certificate for.

• peterwwillis 9y ago
  Correction: that you can control the IP space advertised to Let's Encrypt. A BGP exploit would result in getting valid certs for someone else's domain/host. It's almost trivial to exploit BGP, which is why PKI is so important... so it should actually be incredibly difficult to get a cert.
  • discreditable 9y ago
    If someone is hijacking BGP to MITM the world, how are the old methods any better?
    • snuxoll 9y ago
      If you could hijack BGP you could just as easily inject routes to intercept DNS requests as well.
      • walrus01 9y ago
        This is why ISPs use tools like RPKI validation of received routes, and things like the ARIN, RADB and RIPE route-servers.
        • icedchai 9y ago
          Almost nobody uses RPKI: https://rpki-monitor.antd.nist.gov/ https://rpki-monitor.antd.nist.gov/