Hacker News Reader

> Could you prevent or monitor this kind of attack? There are several indications which could be used to discover the attack from day 1:

> All issued SSL/TLS certificates are subject to certificate transparency. It is worth configuring certificate transparency monitoring, such as Cert Spotter (source on github), which will notify you by email of new certificates issued for your domain names

View on HN

> All issued SSL/TLS certificates are subject to certificate transparency. It is worth configuring certificate transparency monitoring, such as Cert Spotter (source on github), which will notify you by email of new certificates issued for your domain names

This seems like the kind of thing domain registrars should do for you.

Who could in theory also be told “don’t notify your client about this specific one”. You’re best off self hosting if you think you’d be a target for these kind of attacks.

It seems that trust is a highly variable quantity, maybe similar to intuition.

Reply on news.ycombinator.com