3 ms·
They can get an SSL certificate for "example.has-a.name", i.e. your subdomain, in one of two ways: 1. They complete a DNS challenge and get a certificate for "
by stevekemp 7y ago
They can get an SSL certificate for "example.has-a.name", i.e. your subdomain, in one of two ways:
1. They complete a DNS challenge and get a certificate for "\\*.has-a.name" - which obviously includes your subdomain.
2. They sneakily point "your-address-here.has-a.name" to an IP they control, get a certificate issued, then point it back to where it should go.
The second option is more hassle, and easier to notice, but the first makes it needlessly complex.
Of course if your actual domain is "bob.com" then this is just a distraction. We're using "your domain" in this case to refer to the subdomain that points to your IPv6 address.
- treysis 7y agoAnd then they have a certificate. What are they going to do with it? It's still not installed on your server.
- yzmtf2008 7y agoSuddenly whatever.has-a.name is pointing to a different IP address and that server has the cert installed. Oops.
- treysis 7y agoSo same trust you put in any 3rd party DNS service. But I agree there's less contractual bindings to this service than an account somewhere that you even might pay some money for it.
- yzmtf2008 7y agoI guess the point of all this discussion is "don't trust a random guy on the Internet that offers to host DNS for you", but also we place way too much trust on DNS.