10

Many certificate authorities these days use the ACME protocol to automate the process of certificate issuance. This includes verifying that the applicant is the owner of the domain. And the most common way of doing this is via the HTTP-01 challenge, which challenges the applicant to serve up a given token from a server over HTTP.

But my question is, if HTTPS is what provides authentication and non-repudiation for the web, how can HTTP, a protocol without these features, be used to bootstrap HTTPS? How does the certificate authority know that the server serving up the challenge token is indeed at the IP address that it says it's at? Isn't this challenge vulnerable to a MITM attack, the very thing that HTTPS seeks to prevent?

Improve this question

1 Answer 1

Reset to default
12

Indeed, the WebPKI is a cached distributed Trust-On-First-Use system. A CA is hosted very close to the internet backbone, and good CAs perform multi-perspective checks, meaning they are hosted at multiple places worldwide, each location connected close to the internet backbone, and they run the DNS or HTTP validation check from multiple locations.

If you are at an internet cafe with hijacked WiFi and try to do TOFU, you'll get MiTM'd. But it is much harder to MiTM the connection between say AWS and GCP - that traffic can probably only be MiTM'd by Amazon, Google, a Tier 1 ISP and the NSA.

Assume that any sovereign national government can MiTM a connection between any server hosted physically inside their country and a server outside the country. So, if e.g. Turkey wanted to MiTM any server in Turkey, it can. The government of Turkey can also order a Turkish CA to issue certificates that would be trusted by all browsers.

The protection against a CA being fooled by MiTM is the same as the protection against a CA being suborned and a CA being hacked: Certificate Transparency logs will show a certificate for your domain that you did not authorize. If this is noticed and reported, this will lead to the CA being nuked from orbit, live on mozilla.dev.security.policy. You can monitor the major trusted certificate transparency logs for your domains (or pay someone to do it for you, or someone else).

Improve this answer
6
  • 3 very good points: 1. TOFU 2. MiTM is pretty hard 3. CT logs. This clears it up for me thank you
    – Jonah
    Commented Apr 1, 2020 at 18:27
  • "If this is noticed and reported, this will lead to the CA being nuked from orbit" I don't think that would work in the case of a certificate obtained via a MITM attack, since in that case the CA would have done nothing wrong.
    – Ajedi32
    Commented May 10, 2021 at 20:52
  • If it's TOFU, how come certbot requires the domain validation step on every renewal? Shouldn't they just have to it once, and then they've already got your public key? Or is that just an implementation of certbot specifically, and other acme clients could choose to only need domain validation once? Or are subsequent domain validations done over HTTPS using the previous cert or something?
    – Mohamed Hafez
    Commented Apr 6, 2022 at 3:35
  • 1
    What if you sold the domain? The CA must validate you control the domain during renewal.
    – Z.T.
    Commented Apr 6, 2022 at 3:38
  • 1
    Subsequent validation is done like first validation.
    – Z.T.
    Commented Apr 9, 2022 at 9:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .