Re:Let's Encrypt Overview
by macNchz on Friday June 12, 2015 @03:51PM
(#9708154)
I think that this is a common way of verifying domain ownership, but something harder to spoof without actually owning the domain, like setting a custom TXT record or being able to respond to a WHOIS contact email would seem to make more sense than file upload.
[ Parent
| on HN ]
Even if this is common, you have to expect fake certs will be easier to get if there's no cost in failure.
If you need to pay for a cert before seeing if your hack worked, there will be less attempts.
This way, if your mitm failed, you didn't lose anything.