4 ms·
On my webserver (http-01 challenge type). Fresh hostname. Fresh VM. Fresh certbot install.
by CKN23-ARIN 8y ago
On my webserver (http-01 challenge type). Fresh hostname. Fresh VM. Fresh certbot install.
- shawnz 8y agoThat's not a DNS challenge.
- peterwwillis 8y agoNo, but it is a good example that CAs don't require DNS changes to assign a cert. One just needs to MITM an HTTP connection for a single request. (Or, depending on the CA, control one of the following email addresses: "admin@example.com, administrator@example.com, postmaster@example.com, webmaster@example.com, hostmaster@example.com")
- CKN23-ARIN 8y agoHTTP challenges do not offer meaningfully increased resistance to MitM over DNS challenges, and require measurements from multiple vantage points just as much as DNS challenges do.
- deleted 8y ago[deleted]