Hacker News Reader

I point to this recent case of a BGP hijack where an attacker got a certificate issued

https://nitter.lacontrevoie.fr/rmhrisk/status/15749933380840...

Let's Encrypt issues certs based on challenges. One challenge method is that they make an http request to the domain. If they get the correct response back then they will give you the cert. So what you would do is request a certificate, intercept the challenge, and answer correctly.

Edit: If you did this, it would be show up in certificate transparency logs. So a very alert sysadmin could catch you in the act.

There is a blog post here that describes how to exploit it: https://www.mike-gualtieri.com/posts/chaining-remote-web-vul...