Hacker News Reader

Part of getting a certificate from Let's Encrypt involves getting a file from them that you then serve from a certain URL on your domain. Someone without enough control over your server to be able to do that won't be able to issue a certificate for it. This is called a "domain-validated" certificate.

It's not self-signed: Let's Encrypt is a certificate authority, which signs the certificates it issues.

View on HN

I think their point is that any connection that LE makes to example.com in order to verify ownership will be insecure and thus vulnerable to MITM.

Not a problem specific to LE, but to any DV cert.

It it also possible to perform DNS validation, which is my preferred method as I can automate certificate generation/replacement from Ansible.

Reply on news.ycombinator.com