Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Thomas Steen Rasmussen (tykling@mastodon.social)'s status on Thursday, 16-Nov-2023 02:11:41 JST Thomas Steen Rasmussen

   I was investigating an MITM today where the attacker was using a real LetsEncrypt certificate. This was possible because an NS record domain expired and was re-registered by the attacker

   A few weeks ago there was also the jabber.ru MITM issue where a valid LE cert had also been issued.

   Both of these attacks could have been avoided by using CAA account pinning.

   You should add this on all domains today!

   For an example see the CAA record for bornhack.dk https://caatest.co.uk/bornhack.dk

   Spread the word!