Many certificate authorities these days use the ACME protocol to automate the process of certificate issuance. This includes verifying that the applicant is the owner of the domain. And the most common way of doing this is via the HTTP-01 challenge, which challenges the applicant to serve up a given token from a server over HTTP.

But my question is, if HTTPS is what provides authentication and non-repudiation for the web, how can HTTP, a protocol without these features, be used to bootstrap HTTPS? How does the certificate authority know that the server serving up the challenge token is indeed at the IP address that it says it's at? Isn't this challenge vulnerable to a MITM attack, the very thing that HTTPS seeks to prevent?


Indeed, the WebPKI is a cached distributed Trust-On-First-Use system. A CA is hosted very close to the internet backbone, and good CAs perform multi-perspective checks, meaning they are hosted at multiple places worldwide, each location connected close to the internet backbone, and they run the DNS or HTTP validation check from multiple locations.

If you are at an internet cafe with hijacked WiFi and try to do TOFU, you'll get MiTM'd. But it is much harder to MiTM the connection between say AWS and GCP - that traffic can probably only be MiTM'd by Amazon, Google, a Tier 1 ISP and the NSA.

Assume that any sovereign national government can MiTM a connection between any server hosted physically inside their country and a server outside the country. So, if e.g. Turkey wanted to MiTM any server in Turkey, it can. The government of Turkey can also order a Turkish CA to issue certificates that would be trusted by all browsers.

The protection against a CA being fooled by MiTM is the same as the protection against a CA being suborned and a CA being hacked: Certificate Transparency logs will show a certificate for your domain that you did not authorize. If this is noticed and reported, this will lead to the CA being nuked from orbit, live on mozilla.dev.security.policy. You can monitor the major trusted certificate transparency logs for your domains (or pay someone to do it for you, or someone else).

  • 3 very good points: 1. TOFU 2. MiTM is pretty hard 3. CT logs. This clears it up for me thank you
    – Jonah
    Apr 1 '20 at 18:27
  • "If this is noticed and reported, this will lead to the CA being nuked from orbit" I don't think that would work in the case of a certificate obtained via a MITM attack, since in that case the CA would have done nothing wrong.
    – Ajedi32
    May 10 at 20:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.