Re:DigiCert .arpa Mis-Issuance
by ploxiln on Friday March 01, 2019 @06:58PM
(#19286472)
> someone with control over example.github.io might have been able to get a certificate for any github.io domain
I think that, realistically, that's a lot less likely. I think the "weirdness" of the in-addr.arpa hierarchy contributed to the "manual validators" just shrugging and pushing through.
I think the main issue raised is that whois record checking is becoming manual and silly because of whois throttling and captchas and GDPR concerns ... in many cases it's not really working well enough to issue certificates based on.
Re:DigiCert .arpa Mis-Issuance
by julianlam on Saturday March 02, 2019 @10:01AM
(#19289496)
I understand the need for manual checks in some places, but if the natural reaction to seeing in-addr.arpa is to shrug and push through, then there's a definite policy violation here.
I think that, realistically, that's a lot less likely. I think the "weirdness" of the in-addr.arpa hierarchy contributed to the "manual validators" just shrugging and pushing through.
I think the main issue raised is that whois record checking is becoming manual and silly because of whois throttling and captchas and GDPR concerns ... in many cases it's not really working well enough to issue certificates based on.