News for hackers. Stuff that matters.

A comment on Let's Encrypt and Nginx – State of the art secure web deployment. Parent comment

Re:Let's Encrypt and Nginx – State of the art secure web dep... by icebraining on Thursday March 31, 2016 @06:20PM (#11401038)
The question is how to ensure you're getting the right fingerprint. If you have that, you can just as easily fetch the key using HTTP and verify it.
[ Parent | on HN ]
Re:Let's Encrypt and Nginx – State of the art secure web dep... by rlpb on Friday April 01, 2016 @12:36PM (#11406186)
I covered that when I talked of the security of the instructions. The real question is how to ensure you're getting the right instructions, since they could direct you to download a different source entirely.

If you have ensured that you're getting the right instructions, and those instructions supply the right fingerprint, then you can be sure that you have the right fingerprint.

[ Parent | on HN ]