/ Register

Want to subscribe to topics you're interested in?
Become a Member

Letsencrypt IMPORTANT: What you need to know about TLS-SNI validation issues

Discussion in 'Domains, DNS, Email & SSL Certificates' started by buik, Jan 19, 2018.

Tags:
Previous Thread Next Thread
Loading...
  1. Jan 19, 2018 #1
    buik

    buik “The best traveler is one without a camera.”

    2,044
    527
    113
    Apr 29, 2016
    Flanders
    Ratings:
    +1,691
    Local Time:
    3:43 AM
    On 2018-01-09 we got a report from Frans Rosén of Detectify that one of our three validation methods, TLS-SNI-01, could be used to get certificates for domains you don’t own, if those domains were hosted on software that allowed upload of arbitrary certificates. We immediately disabled TLS-SNI-01. Initially we thought this would be a temporary measure, but we later learned that a lot of hosting software has this issue............

    IMPORTANT: What you need to know about TLS-SNI validation issues
     
  2. Jan 19, 2018 #2
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    11:43 AM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Yeah read that news a while back. Doesn't affect Centmin Mod's addons/acmetool.sh and acme.sh client as we use web root authentication and DNS authentication methods (HTTP-01 or DNS-01). But thanks for heads up !
     
Previous Thread Next Thread
Loading...

.