[Acme] Issuing certificates based on Simple HTTP challenges

[Julian Dropmann <[e-mail]>]

Hello,

maybe I am just a naive concerned user, but in my opinion there is one
major issue with the Simple HTTP challenge and possibly other challenges,
specified by ACME:

Any host which is specified by an A/AAAA record of that domain zone can
obtain trusted certificates in the name of the domain zone owner.
Lets assume I host an private XMPP server using TLS on my own domain using
an SRV record, and I point an A record to a third party hoster which hosts
my public web blog.
Now this third party hoster would be able to obtain signed certificates for
my domain using ACME and use that to host an XMPP service on that domain
using the standard port.
Clients which trust that CA are now perfectly happy connecting to that
entity.

By creating an A record I ofcourse need to trust that host to some degree,
but I still would expect the CA to verify if the requester has control over
the DNS zone itself an not just over a single service running there.

And consequently if it is valid to verify over HTTP, then maybe another CA
validates the domain ownership by a mail service/MX record, and a third one
over XMPP/SRV.

This effectively means, as a domain zone admin, I have to trust every
single service I define, not just to properly deliver this service, but
also not to exploit his ability to obtain signed certificates in my name.

Also you rely on the fact that on UNIX only root can bind on port 80 and
443. Lets assume there is an OS out there which does not enforce this
restriciton,
now any user on that host is able to obtain signed certificates for that
domain.

Maybe I missed something here, but overall this seems to be a very bad idea
to automatically issue certificates without requiring a change in the
actual DNS zone the certificate is issued for.

Kind regards,
Julian Dropmann