HTTPS on Stack Overflow: The End of a Long Road

Re:HTTPS on Stack Overflow: The End of a Long Road by cortesoft on Monday May 22, 2017 @05:47PM (#14397200)

How would they prove that you own every subdomain?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by baby on Monday May 22, 2017 @06:30PM (#14397403)

I'm not sure I understand the question. If you own something.com then you automatically own any possible subdomains.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by cortesoft on Monday May 22, 2017 @07:11PM (#14397600)

The Let's Encrypt process is about validating control of the content on a domain, not about OWNERSHIP of the domain. To get a cert, you just have to be able to update a file at a Let's Encrypt specified location on the domain. This is only proving that you are in control of the website for that specific domain, not that you are in control of the DNS for the entire domain and all subdomains.

Of course if I own a domain, I own all the subdomains. However, being in control of the site served at port 80 for a domain does not mean I own it.

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by lordelph on Tuesday May 23, 2017 @04:44AM (#14399807)

But the ACME protocol, the automation underpinning Let's Encrypt, supports validation via a DNS challenge (adding a specific TXT record to the domain). Would it not be possible to issue wildcards if-and-only-if a DNS challenge succeeds?

[ Parent | on HN ]

Re:HTTPS on Stack Overflow: The End of a Long Road by baby on Tuesday May 23, 2017 @06:19AM (#14400123)

I think you're right.

[ Parent | on HN ]