10 ms·
It does solve it. Unless you know my private key, you can't fake the DNSSEC signatures. The linking DS records in the TLD are presumably out of your control and
by cyberax 8mo ago
It does solve it. Unless you know my private key, you can't fake the DNSSEC signatures. The linking DS records in the TLD are presumably out of your control and in future can be audited through something like Certificate Transparency logs.
So even if you fully control the network path, you will somehow have to get access to my private key material.
- gzread 8mo agoSolves part of it. They still control your HTTP and can make LE issue a certificate for you. So actually solves nothing. Unless you had a CAA record saying only LE certs from your account are valid. And maybe you want that record to be authenticated.
- cyberax 8mo agoAgreed. But I meant that in the world without LE but with DNSSEC+DANE this wouldn't be an issue.
- akerl_ 8mo agoThe attacker did not fake any DNS records. They re-routed traffic to the legitimate IP addresses.