Subject: [Acme] ACME vulnerabilities in SimpleHTTP due to common webservers' default virtual host semantics

From: Niklas Keller <[email-masked]>
Date: Fri, 13 Nov 2015 16:35:00 +0100

This is a followup on "ACME vulnerabilities in SimpleHTTP and DVSNI due to
common webservers' default virtual host semantics", since I don't have that
mail in my archive (was not subscribed to the list back then), I can't
respond directly to that thread. (Stupid mailing lists.)

Could someone explain the exact vulnerability? Since those challenge
payloads are bound to a specific domain, I don't see the problem.
Additionally, I don't see why it's a problem with HTTPS, why is it
mitigated by switching to HTTP? HTTP via port 80 has just the same
semantics for default hosts as HTTPS via 443 has.

Regards, Niklas

---

From: Niklas Keller <[email-masked]>
Date: Thu, 19 Nov 2015 09:41:50 +0100

*push*