4 ms·
Another reason to require https?
by asplake 6y ago
Another reason to require https?
- simon_acca 6y agoIf somebody is in control of the content served via the domain, as this is the case, they can obtain a valid HTTPS certificate
- mamon 6y agoNot necessarily. You can always generate self-singed certificate, yes, but trusted issuers such as Let's Encrypt often use challenges that require you to temporarily modify the DNS record - that wouldn't be possible in this case.
- simon_acca 6y agoThe HTTP-01 challenge for example can be performed on any domain pointing to a machine you control, without the need to further modify DNS records, resulting in a valid certificate accepted by most browsers. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/
- pmlnr 6y agoCare to explain how on earth you believe this is connected to https at all?
- asplake 6y agoBecause you wouldn’t then serve content for a domain for which there is no cert installed