What existing CA's offer this?
The ones i've used (godaddy, startssl, namecheap/ssls.com rapidssl/positivessl) all wanted email verification iirc.
EDIT: of course that's equivalent to verifying the MX. Never mind!
The ones i've used (godaddy, startssl, namecheap/ssls.com rapidssl/positivessl) all wanted email verification iirc.
EDIT: of course that's equivalent to verifying the MX. Never mind!
* DNS: you need to add a specific record to your DNS zone * File: you need to add a specific file to the root of a HTTP server listening on the domain name * Email: they send an email to admin@ on the domain
All three are pretty much ways to check that you are the person in control of the associated DNS.