News for hackers. Stuff that matters.

A comment on Let's Encrypt is adding two additional remote perspectives for domain validation. Parent comment

Re:Let's Encrypt is adding two additional remote perspective... by throw0101c on Monday October 19, 2026 @10:56AM (#50153262)
The attacker could hijack the network and initiate the ACME protocol against the CA in the CAA field. There is a draft for dns-account-01 which allows one to specify an ACME account which is authorized for updates (which uses the account key (and not cert key)):

* https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-ac...

[ Parent | on HN ]
Re:Let's Encrypt is adding two additional remote perspective... by Lex-2008 on Monday October 19, 2026 @01:11PM (#50155013)
haven't heard about dns-account-01, thanks! Heard only about dns-persist-01.

I meant to say that CAA record can also specify account, or at least Let’s Encrypt docs mention it[1]. So unless attacker has access to victim's account - they can't get a cert (unless they can hijack dns, too).

[1]: https://letsencrypt.org/docs/caa/#the-accounturi-parameter

[ Parent | on HN ]
Re:Let's Encrypt is adding two additional remote perspective... by throw0101c on Monday October 19, 2026 @02:36PM (#50156134)
Account seems to be a later extension to CAA:

* https://datatracker.ietf.org/doc/html/rfc8657

[ Parent | on HN ]