3 ms·
And thinking further, I'm not sure how MITM attacks would be useful, or expose anything. They would see the challenge request itself go by, but that's all. Set
by bruce511 4y ago
And thinking further, I'm not sure how MITM attacks would be useful, or expose anything. They would see the challenge request itself go by, but that's all.
Setting up the challenge, and fetching the certificate is done over https (the server acting as a client to LE.)
I suppose the MITM machine could recognizes the challenge, and attempt to then fetch the valid certificate (first?). I don't recall offhand if the client has a nonce for that request, I'd have to go and review the spec.
- schoen 4y agoThe MiTM allows the attacker to itself request and receive a certificate. You're right that it doesn't allow the attacker to tamper with (other than to block) the legitimate site's own attempt to receive certificates, but the legitimate site also can't block the attacker from completing the validation process.