ACME TLS-SNI-01 issuing Let's Encrypt SSL-certs for any domain using shared hosting
summary
Demonstrates a concrete method to obtain valid Let’s Encrypt certificates for domains not owned by creating reachable TLS endpoints on shared hosting and answering the ACME validation correctly, exploiting ACME TLS-SNI-01 and common hostname routing setups. Provides a working proof-of-concept that automates account provisioning, certificate requests and SNI responses, shows which hosting configurations are vulnerable, and documents that certificate issuance succeeds until CAs disable the challenge—effectively a shared hosting takeover exploit.
AI-written summary · about
chapters (6)
- 0:00TLS-SNI-01 and Let's Encrypt intro
- 1:54Domain validation in shared hosting
- 3:06How TLS-SNI-01 issues certs
- 6:14Security risks with TLS-SNI-01
- 7:07SSL cert alternatives & best practices
- 9:03Conclusion & Q&A
related talks
26mSSL all the things
25mSSL All The Things
42mLet's go HTTPS
22mACME: Certificate management has never been easier
31mPractical TLS Advice for Large Infrastructure
31mHow We Solved TLS at Scale: Self-Service, Multi-Tenant Cert-manager
20mBring development closer to production with valid HTTPS certificates
35mDomain Borrowing: Catch My C2 Traffic if You Can