News for hackers. Stuff that matters.

A comment on Google and HTTP. Parent comment

Re:Google and HTTP by lasdfas on Sunday February 25, 2018 @09:31PM (#16462618)
Let's Encrypt just like every other certificate authority validates that you own the domain before giving you a cert. They do that by sending a request to the domain from their servers (via looking up the nameservers via domain registries) and validating the response matches a unique message generated.

You could impersonate google.com on wifi, but you couldn't get a valid cert for google.com because you don't own the nameservers or any of the servers that google.com points to.

[ Parent | on HN ]
Re:Google and HTTP by ohiovr on Monday February 26, 2018 @06:41AM (#16464621)
Thank you! So I'm using a cable modem with a dynamic IP. All someone needs are access to the updater program and credentials to impersonate my domain. So certs are fine and all, as long as those little numbers at the name server never change. I'm a just a hobbyist. Just asking questions, don't mean to offend anyone...
[ Parent | on HN ]
Re:Google and HTTP by petraeus on Tuesday February 27, 2018 @09:48AM (#16473736)
Thats your problem
[ Parent | on HN ]