4 ms·
Well, if you control the host behind the IP, you could have any CA issue a challenge, and successfully pass it (e.g. if Let's encrypt uses the erroneous routes)
by moviuro 8y ago
Well, if you control the host behind the IP, you could have any CA issue a challenge, and successfully pass it (e.g. if Let's encrypt uses the erroneous routes).
So no. The only thing protecting you would be to have the expected hash of the certificate you expect to see (TOFU - Trust on First use, though you're screwed if you didn't contact 1.1.1.1 before the incident!).
- floatingatoll 8y agoIs there a CAA equivalent for ARIN assignments?
- Operyl 8y agoI assume you’re looking for: https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38
- floatingatoll 8y agoNope, that’s not what I’m looking for at all.
- devicenull 8y agoRPKI, but it's barely used
- floatingatoll 8y agoNope, that does not cover certificate issuance for IP addresses in that range.
- vbernat 8y agoThis is currently used to sign ROA. A rogue actor can easily work around that by including the original AS in the AS path of the announce.
- otterlicious 8y agoNot yet. :-( https://tools.ietf.org/html/draft-shoemaker-caa-ip-01 https://tools.ietf.org/html/draft-shoemaker-caa-ip-01
- floatingatoll 8y agoThank you for pointing this out. This is exactly what I’d hoped might exist someday.
- Operyl 8y agoDoesn’t LE use their own resolvers? EDIT: https://community.letsencrypt.org/t/where-does-letsencrypt-resolve-dns-from/37607/2 https://community.letsencrypt.org/t/where-does-letsencrypt-r...