4 ms·
As far as I understand, all they are doing is resolving the ipv6 address in the domain name to an AAAA record that matches the IP address in the name. The doma
by LeonM 7y ago
As far as I understand, all they are doing is resolving the ipv6 address in the domain name to an AAAA record that matches the IP address in the name.
The domain name will still be 'has-a.name', so I don't understand how the certificate part is supposed to work. If anything you'd have to get their TLS cert for this to work, not the other way around.
- takeda 7y agoMaybe that's restriction for LetsEncrypt (I haven't used it myself) but certificates aren't restricted to 2nd level.
- LeonM 7y agoNo, this is nothing specific for Lets Encrypt, this is how PKI works. A certificate is for a domain name, not an IP address. Anyone can point a (sub)domain that they own to an IP address that they do not own. And then get a valid certificate for that domain. I can point an A record to [your-ip].[my-domain] and I will be able to get a valid cert for that address. However, the address in your address bar will still point to [my-domain], not yours.
- shawnz 7y agoYou can get a certificate for an IP address, but LetsEncrypt doesn't support it. So this might be somewhat specific for LetsEncrypt.
- djsumdog 7y agoI think the implication is if there is a security breech at their end, someone could hijack the service to point IPv6 addresses to somewhere unexpected. If it's only used in development, it's not too big a deal, but could still be use to compromise things.