News for hackers. Stuff that matters.

A comment on I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain (2018). Parent comment

Re:I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs fo... by zjs on Wednesday January 30, 2019 @01:05AM (#19033056)
Years ago, an HTTPS-01 challenge was proposed that would have operated like HTTP-01 except using port 443. However, concerns were raised about the safety of this challenge.

I can't find the relevant discussion thread at the moment, but I believe this was because the default configuration in some shared hosting environments would have allowed users to receive certificates to others' websites.

Edit: https://mailarchive.ietf.org/arch/msg/acme/B9vhPSMm9tcNoPrTE...

[ Parent | on HN ]
Re:I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs fo... by aidenn0 on Wednesday January 30, 2019 @11:50AM (#19036716)
That's an amazingly terrible default behavior. This is why we can't have nice things...

[edit] This also means I should probably make a PR for automating DNS-01 with my DNS provider (he.net).

[ Parent | on HN ]
Re:I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs fo... by zjs on Wednesday January 30, 2019 @08:48PM (#19041525)
PRs to add support for new DNS providers have been slow to merge, in part because the support story is complex[0].

However, plugins need not live in the main Certbot repository. Maintaining a plugin yourself may be the lowest-friction way to build one right now (or may have its own challenges; I haven't tried that approach).

Lexicon supports he.net[1] and Certbot provides a class for building Lexicon-based providers[2] with very little effort (although perhaps more effort and duplication than would be ideal[3][4]).

0: https://github.com/certbot/certbot/issues/6504

1: https://github.com/AnalogJ/lexicon/blob/master/lexicon/provi...

2: https://github.com/certbot/certbot/blob/master/certbot/plugi...

3: https://github.com/certbot/certbot/issues/6178

4: https://github.com/certbot/certbot/issues/6621

[ Parent | on HN ]
Re:I exploited TLS-SNI-01 issuing Let's Encrypt SSL-certs fo... by aidenn0 on Friday February 01, 2019 @12:27PM (#19056183)
Thanks for all that information!
[ Parent | on HN ]