4 ms·
"If an attacker has full control over your DNS" Shouldn't this be "over the CAs DNS resolver"? /edit well I guess if the attacker has control over your dns s
by slasaus 12y ago
"If an attacker has full control over your DNS"
Shouldn't this be "over the CAs DNS resolver"?
/edit
well I guess if the attacker has control over your dns server, ofcours, but another vector is to spoof as the CAs resolver when the CA does a lookup for your domain.
- pfg 12y agoControl of any name server used by the CA to resolve your hostname would be enough. That could be either the CAs DNS, any resolver in between (e.g. something like Google's Public DNS, which hopefully no real CA is using) or the authoritative name server of the domain. That is, unless you use DNSSEC.