On: Let's Encrypt Overview

[mike_hearn]

If someone MITMs the connection between the CA and the website itself, then yes. I believe LetsEncrypt uses a variety of proxies around the world to measure the website, so there'd have to be a lot of successful simultaneous MITMs for that to work.

Ultimately you have to bootstrap trust from somewhere. Perhaps in future DNSSEC can be used to solve this problem (though DNSSEC is of course itself just another PKI).

[ikeboy → mike_hearn]

My understanding is that DNSSEC only proves IP. If you're in between the CA and the server, you don't care that the CA has the right IP.

[xorcist → ikeboy]

DNSSEC authenticates DNS records. That can be IP addresses, but it could also be public keys or anything else.