3 ms·
Even in the dns-01 case you only need the one _acme-challenge record to *get* the cert. You only need more records to be able to do something meaningful with yo
by Arnavion 3y ago
Even in the dns-01 case you only need the one _acme-challenge record to *get* the cert. You only need more records to be able to do something meaningful with your cert, eg A/AAAA records that point to your malicious server and serve that cert.
- EAtmULFO 3y agoBest practice is to use CAA records, which would help reduce the impact unless the CAA specifies letsencrypt.
- jiggawatts 3y agoIt’s a terrible practice designed to build a moat for billion-dollar corporations feeling scared of free Let’s Encrypt certificates turning off the money printer.