At the moment many SSL cert providers require that an email be sent to a user on the domain (or the user in the whois record) before issuing a cert. Will the same safeguard be in place for SSL certs issued via let’s encrypt?

All of these methods are different examples of Domain Validation (DV), which is an effort to confirm that the certificate is being issued to the same party that controls the domain name. There are several different methods that existing CAs use for DV, and the methods @jsha describes here are simila…

It looks like the protocol is simple/consistent enough that standalone Discourse instances shound be able to do it.

“using a built-in webserver in the client.” I assume the client is a binary vs a script then?

Hi @kroboto , The client is a Python program, distributed as Python source code. The standalone authenticator plugin in the client uses the Python socket library to accept incoming network connections. Python programs, including those distributed as source code, can easily make and receive network c…

That is actually good to hear. I can read Python. C gives me headaches.

[image] schoen: The standalone authenticator plugin in the client uses the Python socket library to accept incoming network connections. How will I need to adjust my firewall rules to allow these incoming connections? Will there be a list of known hosts/addresses that requests will originate …

I believe that’s because the focus here is AUTOMATING the whole process. Currently all the CAs require a user to receive an email and click on a link to confirm ownership.

Hi @mikev , hopefully you’re running the client software on a server that’s able to accept incoming HTTPS connections from the general public, at least for the duration of the validation process. I’m not sure whether we’ll publish a list of hosts that may perform validations. One security challenge …

[image] schoen: To address this, we might in the future perform validations from several different locations on the Internet. We might not want to let prospective attackers know all of the network paths or locations that they'd have to manipulate in order to interfere with the validation for a p…

Part of the original Boulder (the Let’s Encrypt backend) design is to use multiple validation authorities in order to validate a domain from multiple paths, mainly to avoid this exact problem. The design work for this is still ongoing.

How do you confirm the person asking for the certificate actually owns the domain?

Issuance Tech

Topic		Replies	Views
Querying the DNS from multiple vantage points to address local attackers Issuance Tech	3	3479	August 28, 2015
Understanding http challenge Issuance Tech	10	9058	January 17, 2024
Question about the certificate authority Issuance Tech	8	374	September 27, 2024
How are virtual host domains validated? Help	7	2355	February 9, 2017
Alternate ways of proving domain ownership? Help	2	2343	April 6, 2022

How do you confirm the person asking for the certificate actually owns the domain?

Related topics