3 ms·
To test this, I just now acquired a Let's Encrypt cert using `certbot certonly` while tailing the logs. I received only a single request, from 64.78.149.164.
by CKN23-ARIN 8y ago
To test this, I just now acquired a Let's Encrypt cert using `certbot certonly` while tailing the logs. I received only a single request, from 64.78.149.164. The cert was issued. They did not appear to take a second measurement.
- zaarn 8y agoOn your DNS or on your webserver? Did you use a fresh domain or a domain that has been previously seen in DNS?
- CKN23-ARIN 8y agoOn my webserver (http-01 challenge type). Fresh hostname. Fresh VM. Fresh certbot install.
- shawnz 8y agoThat's not a DNS challenge.
- peterwwillis 8y agoNo, but it is a good example that CAs don't require DNS changes to assign a cert. One just needs to MITM an HTTP connection for a single request. (Or, depending on the CA, control one of the following email addresses: "admin@example.com, administrator@example.com, postmaster@example.com, webmaster@example.com, hostmaster@example.com")
- CKN23-ARIN 8y agoHTTP challenges do not offer meaningfully increased resistance to MitM over DNS challenges, and require measurements from multiple vantage points just as much as DNS challenges do.
- deleted 8y ago[deleted]
- tomwas54 8y agoLet's Encrypt seems to be working on validating from multiple vantage points, by doing or having done this in their staging environment: https://community.letsencrypt.org/t/validating-challenges-from-multiple-network-vantage-points/40955 https://community.letsencrypt.org/t/validating-challenges-fr...