3 ms·
DNS has always been a single-point-of-failure for TLS cert issuance. The threat is real, but not at all unique to this validation method. (For example, an atta
by Ajedi32 8mo ago
DNS has always been a single-point-of-failure for TLS cert issuance. The threat is real, but not at all unique to this validation method.
(For example, an attacker with control of DNS could switch the A record to their server and use that to pass HTTP-01 or TLS-ALPN-01 validation, or update the _acme-challenge TXT record and use that to pass DNS-01.)
- redleader55 8mo agoWhile this is true, improvements in the TLS issuance process should also improve security. When the eventual deprecation of TLS-ALPN-01 and DNS-01 comes, this new method would be completely secure. Here, the record could for example contain a signature from the same key pair used to authenticate the account. The alternative is DNSSEC, but that's avoided by a lot of domains.