> They can intercept traffic --- including DV cert checks --- without touching nameservers.
Huh? I'm talking about certificate issuance and domain ownership here. If a CA can't verify the domain with the registrar then they fail to issue a certificate, it's as simple as that. It's not like they can get a forged response over HTTPS...
> An attacker who controls arbitrary IP addresses can get a DV cert issued without control of the DNS.
What? How? Did you read my comment at all? I was saying the CA needs to have a way to verify ownership with the domain registrar. Over HTTPS, obviously. An attacker can't forget a response, so the worst case is the cert doesn't get issued, which it very much shouldn't be if ownership cannot be verified.
I can't tell whether you're talking about how you think things should work or making claims about how they actually do work. If the latter: no. DV certificate checks don't use HTTPS to validate ownership. The point of DV certificate checks is to provision HTTPS in the first place.
If you control BGP, you can thwart DV checks and get a certificate issued. You can do that without touching the DNS at all.
> I can't tell whether you're talking about how you think things should work or making claims about how they actually do work.
How can you not tell? I was extremely explicit that this was the former in the very first sentence of my initial comment:
>>>>>> Taking a step back here... ___shouldn't___ proving ownership of a domain involve the domain registrar some way, rather than involving whoever happens to host your DNS?
The only reason we have DV certs is because people find normal certs painful to apply for. They're a convenience. Similarly: LetsEncrypt does HTTP challenges, relying on the DNS as a side effect, because lots of people who need certificates do not control their DNS records, even if they "own" the domain.
Huh? I'm talking about certificate issuance and domain ownership here. If a CA can't verify the domain with the registrar then they fail to issue a certificate, it's as simple as that. It's not like they can get a forged response over HTTPS...