Let's Encrypt AUTHZ Reuse and Eternal Account Key

Re:Let's Encrypt AUTHZ Reuse and Eternal Account Key by 0x0 on Tuesday October 25, 2016 @10:38AM (#12788347)

This is interesting in the context of buying and selling domain names. Let's say you pay big $$$ for a fancy .com because you're launching a new product with that name or whatever. The seller could actually possess certificates (or authorizations) that allow them to MITM your fancy expensive domain for up to, what, 3 years. Never really thought of that.

CT logs could prove on the date of purchase that your new domain no longer has any valid certificates in the hands of third parties, but if the third party still holds an authorization, they could sneakily obtain new certificates long after the sale? Or - are authorizations also logged somehow to CT-like logs?

[ Parent | on HN ]

Re:Let's Encrypt AUTHZ Reuse and Eternal Account Key by pfg on Tuesday October 25, 2016 @10:46AM (#12788433)

Yeah, it's definitely something I'm hoping the CA/B Forum will address at some point. Something like a month seems like a sweet spot between not being annoying for new customers when they're in the process of getting multiple certs and not being a huge deal when domains are transferred.

I'm not aware of any kind of "Authorization Transparency" effort. Let's Encrypt were thinking about a way to share logs at some point (IIRC), so it might get included in those, but that's a maybe for the future and not a general solution for all CAs.

[ Parent | on HN ]