I recall that subdomains are their own record inside a DNS, which would imply that anyone can claim that their server is a non-existent subdomain of the real domain
I recall that subdomains are their own record inside a DNS, which would imply that anyone can claim that their server is a non-existent subdomain of the real domain
That isn’t true in general. In fact, it can’t be.
It might be policy for most cases from the well-known certificate authorities, but it’s not part of the protocol or anything like that.
If it were, then it would be impossible to set up your mailserver to begin with because you could never get a certificate for mail.bank.com
Yeah, letsencrypt doesn’t do this for example. They do ask for an email address, but that’s just for expiry notices.
They do require you control the domain, and run it on the server the DNS record points to. When using certbot at least.
I was wrong again today.