News for hackers. Stuff that matters.

A comment on Letsencrypt implemented as a shell script. Parent comment

Re:Letsencrypt implemented as a shell script by Jasper_ on Saturday December 05, 2015 @02:32PM (#10682983)
Doesn't LetsEncrypt require that you have DNSSEC enabled on your domain, as a first step? DV is a valid proof of identity, assuming DNSSEC, right?
[ Parent | on HN ]
Re:Letsencrypt implemented as a shell script by nly on Saturday December 05, 2015 @02:52PM (#10683049)
No, DNSSEC isn't required. LetsEncrypt supports a bunch of DV methods right now[0], but the bottom line is that if someone can control either your DNS server or your web server (any web server on an IP at which your domain points) then they can always get a certificate for your domain. This applies to all DV cert issuance from most CAs afaik.

Full DNSSEC verification by the issuing CA (LetsEncrypt) still wouldn't mitigate attacks against the "Simple HTTP" method.

[0]https://letsencrypt.github.io/acme-spec/#rfc.section.7

[ Parent | on HN ]