Hacker News Reader

Comment by skissane | Hacker News Reader

> CAs should be able to afford to make the requests from multiple sources and compare the results.

Do they actually do that in practice? Are they required to do so? (How many sources and how far distinct?)

To test this, I just now acquired a Let's Encrypt cert using `certbot certonly` while tailing the logs. I received only a single request, from 64.78.149.164. The cert was issued. They did not appear to take a second measurement.

On your DNS or on your webserver? Did you use a fresh domain or a domain that has been previously seen in DNS?

On my webserver (http-01 challenge type). Fresh hostname. Fresh VM. Fresh certbot install.

That's not a DNS challenge.

HTTP challenges do not offer meaningfully increased resistance to MitM over DNS challenges, and require measurements from multiple vantage points just as much as DNS challenges do.

No, but it is a good example that CAs don't require DNS changes to assign a cert. One just needs to MITM an HTTP connection for a single request. (Or, depending on the CA, control one of the following email addresses: "admin@example.com, administrator@example.com, postmaster@example.com, webmaster@example.com, hostmaster@example.com")

Let's Encrypt seems to be working on validating from multiple vantage points, by doing or having done this in their staging environment: https://community.letsencrypt.org/t/validating-challenges-fr...

Reply on news.ycombinator.com