Hacker News Reader

Actually LE could. They would re-issue a new valid cert for your domain without removing the old one. That would enable a MITM attack.

View on HN

One could either spam DNS responses at the LE clients or push bogus BGP routes towards LE, and quite probably other things. And you don’t even need LE’s help to do any of this.

While these kinds of attacks are certainly possible, Let's Encrypt is not blind to them and has mitigations specifically for BGP hijacking for example: https://letsencrypt.org/2020/02/19/multi-perspective-validat...

Reply on news.ycombinator.com