Re:Let's Encrypt Stats
by zeendo on Saturday December 05, 2015 @12:29PM
(#10682563)
...that's only true while the attacker controls the site.
The 90 day window mitigates the effect of the cert being leaked.
Just because I grabbed a site's cert on day doesn't mean I control the site. In fact, there's nothing to say I even compromised the site to get the cert in the first place. Perhaps it was mishandled internally? Or grabbed via a heartbleed-style attack?
The 90 day window mitigates the effect of the cert being leaked.
Just because I grabbed a site's cert on day doesn't mean I control the site. In fact, there's nothing to say I even compromised the site to get the cert in the first place. Perhaps it was mishandled internally? Or grabbed via a heartbleed-style attack?