Peter Eckersley <[email protected]> wrote: >> > Boulder does indeed follow redirects, so that's our current plan. >> >> So, if the verifier follows an HTTP redirect to an HTTPS site (does it >> even have to be same name?), which has a (at that point) bogus >> certificate, and Boulder can cope with that, when why bother having >> the SimpleHTTP check method at all? >> >> Why not just always use SimpleHTTPS?
> Because it is common for webservers to be configured with HTTPS vhosts
> that are a strict subset of the HTTP ones, plus a misallocted
> default/wildcard HTTPS vhost that is controlled by the
> tenant/hypothetical attacker.
Ah, so the attacker can control the wildcard HTTPS, and therefore get HTTPS
certificates for the vhosts that do not have their own HTTPS vhost.
I got it.
--
] Never tell me the odds! | ipv6 mesh networks [
] Michael Richardson, Sandelman Software Works | network architect [
] [email protected] http://www.sandelman.ca/ | ruby on rails [
signature.asc
Description: PGP signature
_______________________________________________ Acme mailing list [email protected] https://www.ietf.org/mailman/listinfo/acme
