WingNews logo WingNews
top | item 47067983

(no title)

IgorPartola | 11 days ago

Am I just stupidly missing something or does this in theory allow anyone who controls a DNS server for my domain or anyone who controls traffic between LE and the DNS server for my domain to get a TLS certificate they can use to impersonate my domain?

I suppose the same is true for DNS-01 but this would make it even easier because the attacker can just put up their LE account instead of mine into the DNS response and get a certificate.

At this point why not just put my public cert into a DNS record and be done with it?

discuss

order

gurjeet|11 days ago

If you don't trust your DNS provider to _not_ do malicious acts against you, you shouldn't be in that relationship.

If someone can perform MITM attack between LetsEncrypt and a DNS server, we've got bigger problem than just certificate issuance.

pests|10 days ago

This is why the big names pay MarkMonitor $250-$1000 per domain with a minimum $10,00/yr spend.

They have a good reputation, lock down the domain technically at all levels, and have the connections and people/social skills to take care of any domain issues involving person-to-person contact.

Which is not easy, I recall spending months like a decade ago on email/phone attempting (successfully) to get my personal domain out of expiry hell (made more complicated by wrong records).

bombcar|11 days ago

Yes, anyone who controls your DNS can get a TLS certificate from anyone who offers them - because, uh, they control your DNS!

Try to figure out a way to block me from getting a TLS certificate if I can modify your DNS.

IgorPartola|11 days ago

That’s fair but I also have to trust every provider between my DNS server and LE’s servers to not intercept DNS responses. Since DNS isn’t encrypted anyone anywhere between them can modify the traffic and get a certificate if I understand correctly.

echoangle|11 days ago

If I control your DNS, I can also just do the HTTP Acme challenge. If you control the DNS, it’s basically your domain anyways.

msmith|11 days ago

To mitigate the threat from an attacker who controls the network between the cert issuer and the DNS server, CAs will check the DNS records from multiple vantage points.

Let's Encrypt has been doing this for several years, and it's a requirement for all CAs as of 2024.

[1] https://cabforum.org/2024/08/05/ballot-sc067v3-require-domai...