Re:DNS alias mode (2020)
by throw0101a on Sunday August 22, 2021 @11:44AM
(#28266392)
> A DNS/HTTP challenge hybrid
Either (a) no one thought of cross-protocol validation signalling, or (b) they thought of it and concluded that it was too convoluted and easy to screw up.
As to why no HTTP check, an observation from another recent thread on LE/ACME:
> For example, `nrmitchi.com` is pointed at Netlify. Netlify can obtain a certificate for `nrmitchi.com` (and `www.nrmitchi.com`, which is also pointed at them). It does not allow Netlify to obtain a cert for `.nrmitchi.com`, nor should it.*
Either (a) no one thought of cross-protocol validation signalling, or (b) they thought of it and concluded that it was too convoluted and easy to screw up.
As to why no HTTP check, an observation from another recent thread on LE/ACME:
> For example, `nrmitchi.com` is pointed at Netlify. Netlify can obtain a certificate for `nrmitchi.com` (and `www.nrmitchi.com`, which is also pointed at them). It does not allow Netlify to obtain a cert for `.nrmitchi.com`, nor should it.*
* https://news.ycombinator.com/item?id=28244246#unv_28249719