3 ms·
Can someone explain why the CSR is exchanged over https? The whole point of a CSR is that an adversary can't fake it and get a key that works for you and the ad
by hueving 11y ago
Can someone explain why the CSR is exchanged over https? The whole point of a CSR is that an adversary can't fake it and get a key that works for you and the adversary.
- dadrian 11y agoThe CSR is signed by the key that is going to be used for HTTPS on the website requesting a certificate. If the CSR wasn't transmitted over HTTPS, since the Let's Encrypt CA has no idea what your key is, a network adversary could replace your CSR with one containing an attacker-controlled key.