News for hackers. Stuff that matters.

A comment on Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates. Parent comment

Re:Show HN: Anchor Relay – A faster, easier way to get Let's... by benburkert on Wednesday August 20, 2025 @02:22PM (#44964640)
We theoretically could, but those certificates would show up in CT logs. (For quick & easy monitoring, you can get an RSS feed for your domain on https://crt.sh/, but it's not the most reliable service.) It would be a reputation killer if we did that, just like it would be for your DNS provider or ISP.
[ Parent | on HN ]
Re:Show HN: Anchor Relay – A faster, easier way to get Let's... by masfuerte on Wednesday August 20, 2025 @02:45PM (#44964893)
Right, but if you want people to trust you, you need to be open about what people are trusting you with. Your original answer seemed obfuscatory.
[ Parent | on HN ]
Re:Show HN: Anchor Relay – A faster, easier way to get Let's... by benburkert on Wednesday August 20, 2025 @03:29PM (#44965429)
Sorry, not trying to obfuscate anything, hopefully this clarifies: users trust us to hold their ACME account key and we only ask for DNS records prefixed with `_acme-challenge.` to be CNAME delegated.

With this we could issue or revoke a new certificate, but we couldn't impersonate them because we don't control the rest of their DNS.

[ Parent | on HN ]
Re:Show HN: Anchor Relay – A faster, easier way to get Let's... by dogleash on Wednesday August 20, 2025 @04:01PM (#44965812)
> we couldn't impersonate them because we don't control the rest of their DNS.

If that were true, nobody would need signed certificates in the first place.

[ Parent | on HN ]