5 ms·
Except, it would have been trivial for them to get Lets Encrypt to issue them a valid cert.
by philjohn 9y ago
Except, it would have been trivial for them to get Lets Encrypt to issue them a valid cert.
- Diederich 9y agoYup, I saw that after I commented. I edited and put a warning at the top of my post.
- Manozco 9y agoit depends, let's encrypt might be performing request from different sources (and then it would need a bigger BGP hijack to fake them)
- notriddle 9y agoIf LetsEncrypt is actually hosted within AWS, then a network request from them to Route53 might not even hit the public internet.
- tialaramex 9y agoYes, Let's Encrypt acknowledges that they perform their validations from multiple observation points on the Internet. They (intentionally) don't provide a list. This occasionally annoys people who have an idea like "I will firewall everything but whitelist Let's Encrypt" and then find out that while you're welcome to try to puzzle out some way to make this work, Let's Encrypt won't help you and when it breaks you get to keep both halves.
- disiplus 9y agoi assume that did not work because the challenge would fail because it looks that only google dns would return invalid results.