still thinking about it ..

but need to be certain that there is absolutely no downtime and that it does not not open a can of worms of browser misbehaviour.

The serious brokenness I've seen in browsers has me worried - and that seems to be getting A LOT worse rather than better!

for example a few months ago I saw

a browser ignore a *valid* dns response (as in trying http still went to the correct site - that's a hint that dns was ok!)

- but using https it went to a different domain - a fake one most likely a password trap! - that kind of thing should NEVER happen!!!

we are told that tls is supposed to help reduce the risk of mitm

- not introduce NEW kinds of mitm risks!

the fact that such an attack was even possible has scared me off somewhat!

sure its probably nothing to do with standards related to tls itself but its not going to help security if popular browsers are THAT broken!

btw this has nothing to do with letsencrypt or any CA as far as I know .. so please don't misinterpret this comment as putting anyone down.

I was only able to see the certificate provided by the attacker (for the wrong domain too - not even in any way related - no not a cdn and not a subdomain - it was entirely unrelated domain that belonged to a different site that looked like it had been hacked - yes did look at the domain i saw on the certificate - obviously wanted to know how the hell this happened! - there was silly hacker vanity stuff visible so guessing that it was hacked and that they stole something from there that might have something to do with how they did it)

I could not see the real certificate of the real website and don't know what CA that might have been using or if anything any CA did or did not do has anything to do with what happened. It was obviously an attack most probably exploiting some kind of browser vulnerability.

but if its a hole in the browser thats a pretty serious kind of hole and thats a pretty popular browser.. I hope the browser fixed it since than and I haven't seen this happen lately but not seeing it exploited doesn't really tell me that its fixed in any update since then.

searched and searched for anything posted anywhere that might explain how such a thing could happen and what, if anything, could be or might have been done to prevent it happening anywhere again - but found nothing in all those months since then.

probably not something seen often but serious enough to be VERY worrying!

btw saw it on three different machines running three different operating systems that same day (same site - same kind of browser, probably not exactly the same version number - but none of them was very old)

- that probably rules out any differences between operating systems being a factor and most likely not just a once-off bug in one single build!

fortunately haven't see it happen again since then but have no way of knowing if that risk is still there!

I have no idea how they got the browser to use a certificate for an unrelated domain or how they made it ignore dns and go to somewhere else.

(as I said unencripted plain http with the http url schema went to the correct site! - so dns probably ok .. so how could this happen using https? - sure if its the wrong certificate a warning is to be expected - fortunately that the browser did do .. but the question is how could it actually go to somewhere different to what the dns returns?