3 ms·
So ACME assumes it's harder to trick a LetsEncrypt server than it is to trick a random browser?
by anderspitman 5y ago
So ACME assumes it's harder to trick a LetsEncrypt server than it is to trick a random browser?
- tinus_hn 5y agoACME is a protocol. LetsEncrypt has checks against popular high value domains (you can’t get a LetsEncrypt certificate for Google.com) and they check from multiple locations and they have to match. It really isn’t much different if you use a commercial CA except you have to pay.
- anderspitman 5y ago> ACME is a protocol Yeah I know. Does the protocol not specify that the records must be checked from multiple locations? That would certainly add a lot of protection, but if it's not required...
- tinus_hn 5y agoIf LetsEncrypt does it anyway, what protection is added by it being required by the protocol?
- toast0 5y agoI can fake DNS for all the clients that come onto my network. And I can drop packets to all the popular DoH services too. If your client hosts its own recursive DNS server that does DNSSEC (which is very rare) and the domain has DNSSEC enabled (which is also very rare), then I would be forced to deny service rather than fake DNS. If I were going to trick a LetsEncrypt server, I need to control their network somehow, and that's a lot harder. LetsEncrypt isn't likely to sign up for my transit services at all of their locations.