3 ms·
Sorry, I edited my comment to remove that aside before you posted your reply. Ultimately this does make the HTTP challenge more secure and I mixed up which CAA
by cyphar 4y ago
Sorry, I edited my comment to remove that aside before you posted your reply. Ultimately this does make the HTTP challenge more secure and I mixed up which CAA bits were already supported.
My point was more about how this doesn't make DNS challenges any more secure because the security of CAA ultimately depends on DNSSEC.
- tialaramex 4y agoPreviously you couldn't tell Let's Encrypt "Just don't use the other challenges" and you couldn't tell them "Just don't let people use their own ACME account" and so even if you only ever do DNS challenges, and you have DNS integrity, bad guys who control one of your systems can run Certbot and get themselves a certificate via the http-01 challenge. So yeah, it doesn't make the DNS challenges more secure, but in some cases it makes it possible to rule out lots of other risks outside DNS, narrowing your attack surface very considerably if you are able to do that. This is about raising the low bar, not the high bar.
- cyphar 4y agoAgreed, but GP was explicitly saying that this makes DNS challenges more secure. I was simply responding to that.