# Attack on domain verification with BGP hijacking

**URL:** <https://community.letsencrypt.org/t/attack-on-domain-verification-with-bgp-hijacking/169>\
**Category:** Issuance Tech\
**Created:** [August 14, 2015, 9:53am UTC](https://community.letsencrypt.org/t/attack-on-domain-verification-with-bgp-hijacking/169 "2015-08-14T09:53:36Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![pfg](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/pfg/32/1924_2.png) [@pfg](https://community.letsencrypt.org/u/pfg)\
**Post date:** [March 9, 2016, 7:22pm UTC](https://community.letsencrypt.org/t/attack-on-domain-verification-with-bgp-hijacking/169/12 "2016-03-09T19:22:09Z")

</div>

> [@asergeyev](#):
>
> disallow issuance of letsencrypt certificate completely or without secondary verification;

It's possible to disallow Let's Encrypt from issuing certificates for a domain with CAA records.

> [@asergeyev](#):
>
> specify additional verification information that hijacker could not control (existing certificate signature or DNS record)

Proof of Possession challenges should help here, and are part of the ACME spec, so I'd imagine Let's Encrypt will implement them eventually, once all the edge-cases have been figured out.

When it comes to Domain-validated certificates, I don't think there's currently any validation mechanism in production at any CA that fully protects against BGP hijacking. In the end, even the more commonly used email validation relies on a TCP/IP connection which can be hijacked just as easily. That being said, Let's Encrypt is doing more than most (if not all) other CAs to mitigate this to a certain degree by supporting CAA and having plans for PoP challenges.

---

_[View the full topic](https://community.letsencrypt.org/t/attack-on-domain-verification-with-bgp-hijacking/169)._