Issuance authority and DNS delegation

[My1]

@TCM

Theoretical question: Should the entity owning your TLD be able to get certs for your domain? If not, why not? They control it, so they own your domain. Why do you assume that every level below every domain is under the clear-cut authority of a single entity?

public suffix, so no.
but technically they could take your authority away for a while for whatever reason, get the cert and give the authority back.

@TCM

I say if user X has authority over userx.github.com, the owner of github.com shouldn't be able to get a cert for userx.github.com.

only with the difference that it's still githubs servers and they could just get the cert with DNS Validation and stuff because you only may upload some files to it but you dont get authority over the domain itself.

@gypsypriest

• If hacker_user gets, somehow, a cert for hacker_user.whitehouse.gov, but can't install the cert on the server, does it matter (theoretically or practically)?

imo yes because if he can MITM people with his own server it might be not funny.

@schoen

the system is making some progress with Certificate Transparency, which Chrome is eventually going to require for all publicly-trusted certificates, so certificates will not be accepted at all unless they've been publicly disclosed

yeah that would help, at least if the domain owners keep track of the certs (or let someone else do it).