Hacker News Reader

Another reason to require https?

If somebody is in control of the content served via the domain, as this is the case, they can obtain a valid HTTPS certificate

Not necessarily. You can always generate self-singed certificate, yes, but trusted issuers such as Let's Encrypt often use challenges that require you to temporarily modify the DNS record - that wouldn't be possible in this case.

The HTTP-01 challenge for example can be performed on any domain pointing to a machine you control, without the need to further modify DNS records, resulting in a valid certificate accepted by most browsers.

https://letsencrypt.org/docs/challenge-types/

Care to explain how on earth you believe this is connected to https at all?

Because you wouldn’t then serve content for a domain for which there is no cert installed

Reply on news.ycombinator.com