5 ms·
> I guess that means for users setting up certs for the first time they can't just put some content up on example.com and need to use DNS or something else to
by iancarroll 12y ago
> I guess that means for users setting up certs for the first time they can't just put some content up on example.com and need to use DNS or something else to prove ownership.
FYI, CAs do this already (HTTP validation), but an easy fix is to generate a self signed cert and pass the fingerprint of it to the CA.
- organsnyder 12y agoNot sure how the self-signed cert would make things better. Couldn't an MITM attacker do the exact same thing? Presumably, the MITM attacker would already be the party making the (fraudulent) request to the CA, so they could submit their own fingerprint.
- iancarroll 12y agoI suppose you're correct, I wasn't thinking that the attacker would also submit the request. I guess if you're MITMing CA requests you're screwed anyhow.
- ZoFreX 12y agoYou are positing a MITM on the CA though, which is a bit trickier than MITM'g a user, I would have thought?