21 ms·
You're missing that HTTP-01 challenge grants you no ability beyond what the check has demonstrated, i.e. you have proven that you're able to serve random file f
by maxgashkov 2mo ago
You're missing that HTTP-01 challenge grants you no ability beyond what the check has demonstrated, i.e. you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection.
There are no comparable _technical_ proof-of-registration methods because all of them would require actual access to registrar control panel and be outright silly ('point the domain to a random nameserver').
So no, proper registrars never use webserver control as means to prove identity or ownership.
- sandeepkd 2mo ago> you have proven that you're able to serve random file from a webserver, so the grant is to allow you to serve them via TLS connection. Its digression from the original topic, still, it goes way far than that, these certificates are signed by a CA that the client devices trusts by the virtue of root certificates installed on the device. If I can some how obtain the SSL/TLS certificate for google then thats a very big deal.
- maxgashkov 2mo agoThat's why it's very unlikely that you will be able to put a file under google.com/.well-known/acme-challenge But if you somehow managed to do that, no one in the right mind would argue that you're free to undelegate the domain or point it to a NS you control.