Embed Notice

I was investigating an MITM today where the attacker was using a real LetsEncrypt certificate. This was possible because an NS record domain expired and was re-registered by the attacker

A few weeks ago there was also the jabber.ru MITM issue where a valid LE cert had also been issued.

Both of these attacks could have been avoided by using CAA account pinning.

You should add this on all domains today!

For an example see the CAA record for bornhack.dk https://caatest.co.uk/bornhack.dk

Spread the word!