Hacker News Reader

Comment by codedokode | Hacker News Reader

http-01 seems absolutely unreliable, any hosting provider or any government can issue fake certificates using it. What a garbage technology.

View on HN

The point is to prove you control a domain. If you are answering traffic to requests from clients at that domain, you control it. Whether you're supposed to have control over it is outside the scope of this validation

If you're answering traffic then it means some service has been delegated to you. And if you were delegated https I think it's fine to give you an https certificate.

But that's not controlling "the domain" in my book. You control the domain if you control the nameserver.

I suppose that's why webpki CAs have been turning off all the flags for uses other than HTTPS.

Heh. But an https cert can be used for quite a bit more than just responding on port 443. Like smtp, pop, databases, etc.

Agreed. On the other hand, these DV certificates only claim to verify who _controls_ the domain. Probably, you can agree that hosting provider and government can also control the domain, no? :)

Moreover, with dns-01, DNS provider can issue fake certificates - unless you self-host DNS - in which case, only your DNS registrar can... and a government.

> Moreover, with dns-01, DNS provider can issue fake certificates - unless you self-host DNS - in which case, only your DNS registrar can... and a government.

Which is what DNSSEC is supposed to help with: the registrar/government would have to replace your DS/KSK with their own. Without DNSSEC queries/replies could potentially be altered over the wire (or you're in a race condition as to whether the real or attacker's reply get back first).

Reply on news.ycombinator.com