News for hackers. Stuff that matters.

A comment on Issue with TLS-ALPN-01 Validation Method. Parent comment

Re:Issue with TLS-ALPN-01 Validation Method by octoberfranklin on Wednesday January 26, 2022 @02:22AM (#30082764)
If they didn't fail open, every time a CA's website went down every single website that used their certificates would go offline as well.

You can imagine the DDOS-ransomers licking their lips at this possibility.

No, "fail open" has always been the only possible way to implement this. Which is why it's a broken idea from the start.

[ Parent | on HN ]
Re:Issue with TLS-ALPN-01 Validation Method by vbezhenar on Wednesday January 26, 2022 @03:02AM (#30082988)
> If they didn't fail open, every time a CA's website went down every single website that used their certificates would go offline as well.

That's not correct. OCSP stamps exist to prevent that kind of a problem.

[ Parent | on HN ]
Re:Issue with TLS-ALPN-01 Validation Method by zauguin on Wednesday January 26, 2022 @07:28AM (#30084687)
OCSP always seemed a bit absurd to me: Instead of sending a OCSP stamp, the CA could also issue a very short lived certificate on demand. It would have the same effect of asserting that the CA currently considers the server to be verified and it doesn't need a separate format.
[ Parent | on HN ]