4 ms·
Its already worse than that. Any provider sitting between you and LetsEncrypt could pass the HTTP challenge on your behalf and get themselves certified as your
by blueflow 3y ago
Its already worse than that. Any provider sitting between you and LetsEncrypt could pass the HTTP challenge on your behalf and get themselves certified as your server.
- rootusrootus 3y agoI'd love to hear how exactly they'd pull that off.
- blueflow 3y agoIn Linux, you can do a dstaddr/dstport based redirect in the iptables FORWARD chain to your own http server and serve the ACME challenge/response things from there. This is basically a transparent proxy setup.
- rootusrootus 3y agoWhat does that buy you? The challenge is merely an authorization, intercepting it does not get you a certificate.
- blueflow 3y agoWhat else would i need to request the certificate?
- 3np 3y agoThe ambition is that this will be addressed by supporting RFC8657[0], which would allow domain owners to restrict HTTP-01 issuance by declaring an issuance policy through DNS records. It's been live at staging for years and still waiting to make it to prod[1]. DNS-01 attacks are by default similarly vulnerable to MitM between the issuer and your DNS server, which can be mitigated by setting up DNSSEC. [0]: https://datatracker.ietf.org/doc/html/rfc8657 https://datatracker.ietf.org/doc/html/rfc8657 [1]: https://community.letsencrypt.org/t/prod-support-for-rfc8657-caa-constraints-for-accounturi-and-validationmethods/181584/2 https://community.letsencrypt.org/t/prod-support-for-rfc8657...