Secure Delegation for Service Hosting Across Domains

[mimi89999]

@MikeMcQ

But, I think you would find the below thread helpful. I linked to post #21 by Aaron Gable so you can see comment from an LE staff person. The entire thread is full of informed and useful info by other volunteers so I recommend that after reading Aaron's post to start at the top

I think that @petercooperjr summarized the issue well:

@petercooperjr

I think the concern is, and I also may not be following completely, the case where _xmpp._tcp.example.com has a SRV record for some-other-host.example.net, along with a client that when trying to connect to XMPP for example.com looks up the some-other-host.example.net server and connects to it, but expects it to present a certificate for example.com rather than a certificate for its own hostname.

There are two possibilities here:

1. The client expects a certificate for example.com. If some-other-host.example.net is third-party hosted, that brings the practical challenges of obtaining such a certificate that I described in my initial post.

2. The client expects a certificate for some-other-host.example.net. In this case, a MITM attack could simply redirect the client to evil.com, and it would connect without complaint.

Also, there was no further comment from @aarongable in that thread.