{"action":"created","issue":{"url":"https://api.github.com/repos/ericandrewlewis/say-yes-to-https/issues/10","labels_url":"https://api.github.com/repos/ericandrewlewis/say-yes-to-https/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/ericandrewlewis/say-yes-to-https/issues/10/comments","events_url":"https://api.github.com/repos/ericandrewlewis/say-yes-to-https/issues/10/events","html_url":"https://github.com/ericandrewlewis/say-yes-to-https/issues/10","id":119397932,"number":10,"title":"Clear-up Domain ownership verification","user":{"login":"ericandrewlewis","id":1087646,"avatar_url":"https://avatars.githubusercontent.com/u/1087646?v=3","gravatar_id":"","url":"https://api.github.com/users/ericandrewlewis","html_url":"https://github.com/ericandrewlewis","followers_url":"https://api.github.com/users/ericandrewlewis/followers","following_url":"https://api.github.com/users/ericandrewlewis/following{/other_user}","gists_url":"https://api.github.com/users/ericandrewlewis/gists{/gist_id}","starred_url":"https://api.github.com/users/ericandrewlewis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ericandrewlewis/subscriptions","organizations_url":"https://api.github.com/users/ericandrewlewis/orgs","repos_url":"https://api.github.com/users/ericandrewlewis/repos","events_url":"https://api.github.com/users/ericandrewlewis/events{/privacy}","received_events_url":"https://api.github.com/users/ericandrewlewis/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-11-30T00:07:18Z","updated_at":"2015-12-03T01:00:30Z","closed_at":null,"body":"In #7, @MacLemon said\r\n> [We should remove the] part with the domain ownership verification by CAs since they actually don't do that. Ownership of a domain is not a requirement for the issuance of a certificate for a hostname under that domain."},"comment":{"url":"https://api.github.com/repos/ericandrewlewis/say-yes-to-https/issues/comments/161482576","html_url":"https://github.com/ericandrewlewis/say-yes-to-https/issues/10#issuecomment-161482576","issue_url":"https://api.github.com/repos/ericandrewlewis/say-yes-to-https/issues/10","id":161482576,"user":{"login":"MacLemon","id":90635,"avatar_url":"https://avatars.githubusercontent.com/u/90635?v=3","gravatar_id":"","url":"https://api.github.com/users/MacLemon","html_url":"https://github.com/MacLemon","followers_url":"https://api.github.com/users/MacLemon/followers","following_url":"https://api.github.com/users/MacLemon/following{/other_user}","gists_url":"https://api.github.com/users/MacLemon/gists{/gist_id}","starred_url":"https://api.github.com/users/MacLemon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MacLemon/subscriptions","organizations_url":"https://api.github.com/users/MacLemon/orgs","repos_url":"https://api.github.com/users/MacLemon/repos","events_url":"https://api.github.com/users/MacLemon/events{/privacy}","received_events_url":"https://api.github.com/users/MacLemon/received_events","type":"User","site_admin":false},"created_at":"2015-12-03T01:00:30Z","updated_at":"2015-12-03T01:00:30Z","body":"What SSLMate does is commonly called a mail-ping. :-) There are a lot of emails in WHOIS information, not all of which are under the control of the domain proprietor. ISPs and registrars also are listed in WHOIS and, for example, StartSSL will happily send pings there. Also, anyone having access to the email server where any of those emails arrive can “klick that link”. This system actually doesn't verify control over the hostname.domain.tld at all, it verifies that someone can read an email.\r\n\r\nThere are other validation methods, like making a CA generated and signed token available on a well-known path on the webserver that shall use the certificate. This is a lot better and actually checks that you have control over the webserver for that hostname. This is essentially what the let's encrypt client tries to do, which still needs a lot of improvement, but that is a totally different story.\r\n\r\nI wouldn't remove the CSR at all, since it is a very necessary step. It would be fine to tell people that **some tools** automate the steps of creating a CSR and sending it to a CA for you. Most of the ones I had to deal with don't. Also keep in mind that CAs not only issue certs for webservers but all kinds of services, like XMPP, Email servers, Code signing, client authentication, etc."}}