Thanks to this nice piece of research this topic can be talked about again: https://i.blackhat.com/eu-18/Thu-Dec-6/eu-18-Heftrig-Off-Path-Attacks-Against-PKI.pdf Would it be somehow possible to enforce certificates only to be issued when the domain is DNSSEC protected? I was also thinking that it …

I think it should be set the first time certificate is issued for a domain using a flag passed to certbot, with Let’s Encrypt remembering to only accept DNS records from this domain if they are signed, unless an opt-out record is found (for example if the domain is about to be sold or transferred). …

[image] anon95262142: I think it should be set the first time certificate is issued for a domain using a flag passed to certbot, with Let’s Encrypt remembering to only accept DNS records from this domain if they are signed, unless an opt-out record is found (for example if the domain is about to…

Expiration should reset DNSSEC requirement.

Then Let’s Encrypt would require access to domain registration information…

New owners have to jump trough hoops if they want to get rid of HSTS preloading as well. IMHO domain expiration needs improvement rather than features being deferred because of it.

HTTP validation is a huge showstopper for me since my reverse proxy cannot be trusted. A way of forcing DNS would be helpful. For instance, LE could honor IN CAA 0 issue dns.letsencrypt.org + compat TXT for CAA-less DNS hosts could imply that only DNS validation would be permitted by LE.

Just noticed this, apparently it’s live in staging now, so will see how that goes.

Way to enforce DNSSEC validation

Feature Requests

mnordhoff January 16, 2019, 7:56am 8

Let's Encrypt wants to deploy the CAA validationmethods extension, but it's been held up by issues with the CAA standard.

Topic		Replies	Views
Lets Encrypt and DNSSEC verification Issuance Tech	6	2978	February 26, 2024
Minor DNSSEC validation change API Announcements	1	351	April 13, 2026
Extended checks if domain already has a EV certificate Issuance Policy	16	5461	April 20, 2017
DNS validation for internal sites Server	6	3355	December 4, 2017
HTTP validation for wildcard certificates Feature Requests	6	5181	September 5, 2017

Way to enforce DNSSEC validation

Related topics