This is a follow-up to other questions like "What makes Let's Encrypt secure?".
When I first run the Let's Encrypt (certbot) client on my server, it obtains a certificate by publishing a certain file on
www.mydomain.example, which proves to the Let's Encrypt service that I really do control the website at
www.mydomain.example. Now I have the certificate, visitors to
https://www.mydomain.example will see a padlock icon.
This indication would be meaningless if Mallory somehow gained the ability to serve pages from
www.mydomain.example, since with that ability she could easily get a new certificate the same way I did. Previous answers have only said that the CA counters this possibility by validating my server from multiple locations around the world.
Am I right in understanding that DV certificates rely on attackers not being able to hijack a DNS entry globally? Is that simply not considered to be a risk?
It occurs to me that CAs could mitigate that risk by requiring that when I renew the certificate, as well as verifying that I control the domain, I must also prove that I have the previous certificate. Even if Mallory somehow steals my domain, she cannot get a new cert for it because she doesn't have the old private key.
Do CAs do something along these lines?
Like most site admins, my main concern is simply to make the padlock icon appear, because users are increasingly warned to avoid sites without it. And, if I didn't use HTTPS, users on public wifi would be sending passwords etc in the clear. But it's still not clear to me what, if anything, that padlock should be assumed to prove.