• 0 Posts
  • 3 Comments
Joined 3 years ago
cake
Cake day: June 14th, 2023

help-circle
  • No they weren’t, how did you get that idea? Nowhere did they ask for a specific fix, nor did they provide the details necessary for a specific fix. The OP asked how it works, and according to my reading of both their post and their comment, they seemed quite curious about what was going on (which is a good mindset to have when attempting to solve a problem) so my intention was to answer some of that curiosity by explaining “how”. You’re the one who decided someone should just provide a fix (which, in this case, would’ve been basically impossible)

    Especially when a problem arises because of misunderstanding or ignorance (which is not a shameful thing, it’s simply the default state of understanding), an improved and better understanding of the situation often helps lead one quite quickly to the solution to the problem, and in this case, it seems like OP did solve their own problem once they had a better understanding, so… seems like a successful effort to me? Any particular reason we need to argue about this?


  • It works the same way it normally works. You generate the certificate, give it to them, tell them who you are, they verify who you are, then they sign it and give it back to you. Very routine and straightforward, except for the challenge part that they use to verify your identity.

    Think of it in terms of delivering a pizza. The signed certificate is the pizza in this analogy, and they don’t want to send it to you until they’re sure it’s going to the right place. Either the store can send it to you (you have to give them your address and have port 80 open for when they arrive) or you can go pick it up at the store (you give them your address, they verify it through DNS, no port 80 required).

    There’s never been anything preventing you from establishing a conversation with the certificate-issuer. You don’t need port 80 open for that. However, unless you have port 80 open the issuer cannot reach out to you, and that’s how they verify you are who you say you are. DNS challenges avoid them having to reach out to you directly, instead they reach out to DNS on your behalf and verify you are who you say you are that way instead.