3 ms·
If somebody is in control of the content served via the domain, as this is the case, they can obtain a valid HTTPS certificate
by simon_acca 6y ago
If somebody is in control of the content served via the domain, as this is the case, they can obtain a valid HTTPS certificate
- mamon 6y agoNot necessarily. You can always generate self-singed certificate, yes, but trusted issuers such as Let's Encrypt often use challenges that require you to temporarily modify the DNS record - that wouldn't be possible in this case.
- simon_acca 6y agoThe HTTP-01 challenge for example can be performed on any domain pointing to a machine you control, without the need to further modify DNS records, resulting in a valid certificate accepted by most browsers. https://letsencrypt.org/docs/challenge-types/ https://letsencrypt.org/docs/challenge-types/