Hacker News new | ask | show | jobs
by tptacek 1121 days ago
None of this matters. An attacker who controls BGP controls IP routing. They can defeat ACME.
1 comments

TLSA record can specify what specific hash the certificate must have (DANE-EE). You can't solve that with BGP and ACME. The certificate that you get from acme will have a different hash.

With CAA records you can also lock it down to a specific user and method (RFC 8657). How will you solve that with BGP using acme?