2 ms·
The ACME protocol allows this; you just need to control either the DNS records or port 80 on all of the network paths that the certificate authority (e.g. Let’s
by hedora 3y ago
The ACME protocol allows this; you just need to control either the DNS records or port 80 on all of the network paths that the certificate authority (e.g. Let’s Encrypt) uses as part of the challenge response protocol.
(Is there a way to permanently opt a DNS name out of such things, I wonder? It seems unlikely that anything would survive a DNS name transfer.)
- SushiHippie 3y agoHow do you intend to generate a certificate if you opted-out of these methods?
- hedora 3y agoWith a traditional Certificate Authority that confirms real-world identities.
- deleted 3y ago[deleted]
- 3np 3y agoTo some extent, yes: RFC8657 https://community.letsencrypt.org/t/prod-support-for-rfc8657-caa-constraints-for-accounturi-and-validationmethods/181584 https://community.letsencrypt.org/t/prod-support-for-rfc8657... https://www.rfc-editor.org/rfc/rfc8657 https://www.rfc-editor.org/rfc/rfc8657 Though if your threat-model includes local- and/or internet authorities, you probably want to start thinking about alternative roots of trust.