4 ms·
> That's kind of the thing that certificate validation is supposed to solve, an attacker posing as you [...] No, not really. Certificates get issued to hostnam
by Avamander 1y ago
> That's kind of the thing that certificate validation is supposed to solve, an attacker posing as you [...]
No, not really. Certificates get issued to hostnames and less frequently, IP addresses. If someone has full control over that resource then what's the actual difference between "you" and "attacker"? Should they run a malware scan too that your server is not compromised?
It's not a thing a CA can solve if you've completely lost control of your infrastructure.
- 1718627440 1y agoOK, I misunderstood you. I interpreted: > if someone can become the thing you're trying to validate as someone able to impersonate you, not someone actually owning your server. For the latter you're right.