4 ms·

Domain validation has been available from multiple CAs by placing a root-level file on your webserver for years. If your domain points to a server controlled by

Domain validation has been available from multiple CAs by placing a root-level file on your webserver for years. If your domain points to a server controlled by a third party, they have always been able to pass domain validation.

0x0 12y ago
Does cloudflare require A records or NS records to point to them before issuing the cert? I guess maybe that could work. I'm still a little skeptical about the whole no-interaction-required part. Is there no way this is open to abuse? Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? Maybe it's no different than regular automatic domain validation though. Hopefully the backend that requests and retrieves new SSL certificates from the CA cannot be compromised.
- innocenat 12y ago
  > Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.
  - 0x0 12y ago
    I guess you're right about that, but it still feels a bit weird that a third party can just allocate a private key and a valid certificate without the actual owner of the domain requesting it.
    - iancarroll 12y ago
      CloudFlare just simplifies this process. You can do the same thing if you can upload a file to a site.
      - spacefight 12y ago
        It's not the simplification - it's that they do it for all their clients at once - no opt-in.
    - zyx321 12y ago
      Yes, but that's an SSL "design flaw" that's been known literally for decades. Go take a look at your browser's trusted root certificates some time. Everyone here likely knows on a cognitive level that SSL is pretty damn broken, but being reminded of the fact still feels rather disconcerting.
    - grey-area 12y ago
      If you've given up control of the DNS on your domain to a third party, they can do whatever they want with that domain - they ultimately control email, web, and any other services on that domain. so if you use cloudflare, you've already given up that control and trust them completely with your domain. This is what makes me hesitant about using cloudflare or recommending it to clients; you give up a lot of control over your data and domains.
      - organsnyder 12y ago
        That's always going to be true at some level—even if you're hosting DNS yourself. I self-host the DNS for many of my domains on a Linode VPS. If Linode decides that they don't like me (or they just make a mistake) and re-allocates my IP addresses to someone else, they could set up their own DNS server to direct my domains however they please. However, I trust Linode to not do this, based on their track record and reputation. You're always at the mercy of at least one vendor, unless you own your own block of IP addresses and advertise it via BGP (and even then, someone could make their own malicious advertisement of your IP block). You can't eliminate the risk. At some point, you have to set the threshold for what risk you consider acceptable. For many organizations, using Cloudflare provides enough benefit to outweigh the slightly higher risk of something going wrong.
      - xorcist 12y ago
        > If you've given up control of the DNS on your domain to a third party, they can do whatever they want with that domain Unless you're using DNSSEC..!
- deleted 12y ago
  [deleted]

0x0 12y ago

Does cloudflare require A records or NS records to point to them before issuing the cert? I guess maybe that could work. I'm still a little skeptical about the whole no-interaction-required part. Is there no way this is open to abuse? Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? Maybe it's no different than regular automatic domain validation though. Hopefully the backend that requests and retrieves new SSL certificates from the CA cannot be compromised.

innocenat 12y ago
> Could a third party sign up to cloudflare for a domain they do not own and somehow spoof the checks? You need to point the your domain to CloudFlare nameserver. I don't think you can do that unless you actually control the domain.
- 0x0 12y ago
  I guess you're right about that, but it still feels a bit weird that a third party can just allocate a private key and a valid certificate without the actual owner of the domain requesting it.
  - iancarroll 12y ago
    CloudFlare just simplifies this process. You can do the same thing if you can upload a file to a site.
    - spacefight 12y ago
      It's not the simplification - it's that they do it for all their clients at once - no opt-in.
  - zyx321 12y ago
    Yes, but that's an SSL "design flaw" that's been known literally for decades. Go take a look at your browser's trusted root certificates some time. Everyone here likely knows on a cognitive level that SSL is pretty damn broken, but being reminded of the fact still feels rather disconcerting.
  - grey-area 12y ago
    If you've given up control of the DNS on your domain to a third party, they can do whatever they want with that domain - they ultimately control email, web, and any other services on that domain. so if you use cloudflare, you've already given up that control and trust them completely with your domain. This is what makes me hesitant about using cloudflare or recommending it to clients; you give up a lot of control over your data and domains.
    - organsnyder 12y ago
      That's always going to be true at some level—even if you're hosting DNS yourself. I self-host the DNS for many of my domains on a Linode VPS. If Linode decides that they don't like me (or they just make a mistake) and re-allocates my IP addresses to someone else, they could set up their own DNS server to direct my domains however they please. However, I trust Linode to not do this, based on their track record and reputation. You're always at the mercy of at least one vendor, unless you own your own block of IP addresses and advertise it via BGP (and even then, someone could make their own malicious advertisement of your IP block). You can't eliminate the risk. At some point, you have to set the threshold for what risk you consider acceptable. For many organizations, using Cloudflare provides enough benefit to outweigh the slightly higher risk of something going wrong.
    - xorcist 12y ago
      > If you've given up control of the DNS on your domain to a third party, they can do whatever they want with that domain Unless you're using DNSSEC..!
deleted 12y ago
[deleted]