5

This question already has an answer here:

LetsEncrypt allows you to verify ownership of your domain using the .well-known thing, but since the site is http before the first certificate is issued, couldn't somebody do an MITM attack to give letsencrypt the response it wants without actually owning the domain? I'm pretty sure the people at LE know what they're doing, I just want to know how it works.

EDIT:

To clarify, I am talking about spoofing the entire process, not just guessing the nonce used after a legitimate owner begins the process. I am talking about an attacker running certbot and doing the entire thing.

marked as duplicate by Arminius, Serge Ballesta, Anders, Matthew, Rory Alsop May 4 '17 at 19:59

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Doesn't Let's Encrypt use (untrusted) HTTPS for the verification? Of course this first connection isn't more secure than plain HTTP but it's technically HTTPS. – Arminius May 4 '17 at 4:45
  • Also, this thread is discussing that issue. – Arminius May 4 '17 at 4:52
  • 1
    Yes this is a risk with online based DV. CAs have to mitigate this, for example by using multiple routes to the destination IP for the verification calls. – eckes May 5 '17 at 6:31
  • If I understand this right, the duplicate isn't talking about guessing the nonce. It is talking about MITM Lets Encrypt which is what you ask as well. – Anders May 5 '17 at 7:24
3

couldn't somebody do an MITM attack to give letsencrypt the response it wants without actually owning the domain?

Yes, someone who knows the response Let's Encrypt expects could provide it. But, the response is created by using a private key only known to the owner of the server where the matching public key is known by Let's Encrypt. Thus it is practically impossible for some man in the middle to guess the correct response.

For more details see How It Works from Let's Encrypt which includes the following description:

Along with the challenges, the Let’s Encrypt CA also provides a nonce that the agent must sign with its private key pair to prove that it controls the key pair.

Of course, if the attacker fully controls access to the domain he can create a new account with Let's Encrypt and get a certificate for this domain. But in this case the attacker is essentially owning the domain not only from the perspective of Let's Encrypt but also other third parties.

  • 1
    As I understand it, the question is more about MITM-ing an entire verification process which wouldn't require an attacker to guess any nonces. – Arminius May 4 '17 at 4:57
  • @Arminius: in my opinion the question clearly is about the process which verifies the challenge (reference to .well-known suggests this). In this case the attacker must not guess the nonce (which is probably visible in the HTTP request) but he must know the private key of the domain owner which is used to sign the nonce. – Steffen Ullrich May 4 '17 at 5:04
  • @Arminius understands what I am asking. – markasoftware May 4 '17 at 23:37
  • @Markasoftware: in this case see the last paragraph of the answer, i.e. the attacker essentially owns the domain and therefore can get certificates for it. This is not limited to Let's Encrypt but is the same with most or even all domain validation methods. – Steffen Ullrich May 5 '17 at 4:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.