Lex-2008 5 hours ago

> http-01

Good point, I forgot about that! But then CAA record might help, I guess, if you specify your accounturi?

The attacker could hijack the network and initiate the ACME protocol against the CA in the CAA field. There is a draft for dns-account-01 which allows one to specify an ACME account which is authorized for updates (which uses the account key (and not cert key)):

* https://datatracker.ietf.org/doc/html/draft-ietf-acme-dns-ac...

▲

Lex-2008 3 hours ago | parent [-]

haven't heard about dns-account-01, thanks! Heard only about dns-persist-01.

I meant to say that CAA record can also specify account, or at least Let’s Encrypt docs mention it[1]. So unless attacker has access to victim's account - they can't get a cert (unless they can hijack dns, too).

[1]: https://letsencrypt.org/docs/caa/#the-accounturi-parameter

	▲	throw0101c an hour ago \| parent [-]
		Account seems to be a later extension to CAA: * https://datatracker.ietf.org/doc/html/rfc8657