3 ms·
Yes, anyone who controls your DNS can get a TLS certificate from anyone who offers them - because, uh, they control your DNS! Try to figure out a way to block
by bombcar 9mo ago
Yes, anyone who controls your DNS can get a TLS certificate from anyone who offers them - because, uh, they control your DNS!
Try to figure out a way to block me from getting a TLS certificate if I can modify your DNS.
- IgorPartola 9mo agoThat’s fair but I also have to trust every provider between my DNS server and LE’s servers to not intercept DNS responses. Since DNS isn’t encrypted anyone anywhere between them can modify the traffic and get a certificate if I understand correctly.
- mcpherrinm 9mo agoTwo current mitigations and one future: DNSSEC prevents any modification of records, but isn’t widely deployed. We query authoritative nameservers directly from at least four places, over a diverse set of network connections, from multiple parts of the world. This (called MPIC) makes interception more difficult. We are also working on DNS over secure transports to authoritative nameservers, for cases where DNSSEC isn’t or won’t be deployed.
- IgorPartola 9mo agoAh that makes sense. I was wondering why I haven’t heard of cases of successfully attacks like this. Thank you for the info!