3 ms·
> man-in-the-middling Let's Encrypt and a particular domain (or DNS, depending on the domain validation challenge) Let's Encrypt issues multiple verification r
by Denvercoder9 6y ago
> man-in-the-middling Let's Encrypt and a particular domain (or DNS, depending on the domain validation challenge)
Let's Encrypt issues multiple verification requests from multiple servers in different locations, both physically and in the network topology. If you can MITM that, you've pretty much taken over the domain and the ability to get a certificate isn't the worst of the operators problems.
- marcosdumay 6y ago> and the ability to get a certificate isn't the worst of the operators problems That assumes a lot about the operators goals and values. It may very well be their worst problem. Eg. a journalist in a dictatorial area will very likely prefer not to have a cloud service than to upload his data into some compromised service. It's just that, if it is their worst problem, TLS is patently insufficient, so they must think about it when setting the system up.