CNAME'ing pool-ntp.tesla.com to something they do not control is already quite risky as it would allow someone to e.g. request pool-ntp.tesla.com certificate though it might take quite a few tries.

▲

robinpie 4 hours ago | parent | next [-]

I thought about trying this, but MPIC makes it very very very difficult (the round-robin has some geolocation magic baked in regarding what server it connects you to).

▲

ratorx 4 hours ago | parent [-]

Out of curiosity, how is MPIC relevant? Not that familiar with it, but CNAME would resolve to your server regardless no?

▲

robinpie 4 hours ago | parent [-]

pool-ntp.tesla.com --CNAME--> pool.ntp.org --GeoDNS--> thousands of possible servers, biased heavily by user location

	▲	ratorx 4 hours ago \| parent [-]
		Oops should have RTFA before commenting, I thought the CNAME was only to your servers.

▲

sippingabonedry 4 hours ago | parent | prev [-]

Wouldn't the same apply to pool.ntp.org then?

Maybe running a web server on the same IP as an NTP server is a bad idea.

▲

Polizeiposaune 4 hours ago | parent [-]

a .tesla.com certificate might well enable more shenanigans than a .pool.ntp.org cert.

▲

jan_tilde_zone 4 hours ago | parent | next [-]

Hope there are no sensitive *.tesla.com cookies out there...

	▲	sippingabonedry 4 hours ago \| parent [-]
		The chance of being issued a certificate in this instance, while theoretically possible, is infinitesimally small.

▲

sippingabonedry 4 hours ago | parent | prev [-]

That points to a glaring hole in the modern-day automated web PKI, not Tesla's dangling DNS record.

Hell, they issue certificates to IP addresses now. For cloud systems, ownership of an IP could be a few hours.

This has almost certainly been deemed an acceptable risk.

	▲	SahAssar an hour ago \| parent \| next [-]
		> That points to a glaring hole in the modern-day automated web PKI, not Tesla's dangling DNS record. It's not. They control a long-term high-value asset (the domain tesla.com). They decided to delegate part of that asset to a large number of "random" people that they do not have a contract or agreement with. Being able to issue certs for cloud IPs has nothing to do with this since it is not a long term asset, and if it is you probably don't delegate it to random people to control unless you do not value that asset.
	▲	xmodem 3 hours ago \| parent \| prev [-]
		This is why IP certificates are limited to a max lifetime of 6 days. > IP address certificates allow server operators to authenticate TLS connections to IP addresses rather than domain names. Let’s Encrypt supports both IPv4 and IPv6. IP address certificates must be short-lived certificates, a decision we made because IP addresses are more transient than domain names, so validating more frequently is important. https://letsencrypt.org/2026/01/15/6day-and-ip-general-avail...