David Osipov DavidOsipov

$argon2id$v=19$m=64,t=512,p=2$SfpLVj9WHxeQXQDPcO8epg$yrRS3qXk4qWDyMto/rcZ3w

I hereby claim:

To claim this, I am signing this object:

	# How the 2023 MitM Attack Reveals a Critical Security Gap in Cloudflare's Universal SSL

	<img src="https://habrastorage.org/r/w780/getpro/habr/upload_files/5a0/731/17c/5a073117c595a0da5299bf14b4136cf9.jpg" alt="A wounded knight in armor slumped in defeat, holding a large shield with the Cloudflare logo that has been pierced by a bullet hole." width="200"/>
	## Summary

	* Cloudflare's free Universal SSL automatically adds broad [CAA records](https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization) (e.g., issue "letsencrypt.org") without the accounturi parameter from RFC 8657.
	* This creates the exact security gap that enabled the [jabber.ru MitM attack](https://notes.valdikss.org.ru/jabber.ru-mitm/) back in 2023, where attackers got a valid Let's Encrypt certificate because they could pass domain validation from a different LE account.
	* I have tried to get Cloudflare to address this on their [community forum](https://community.cloudflare.com/t/critical-security-gap-cloudflare-must-fully-suppor

	# /etc/sysctl.conf - Configuration file for setting system variables
	# See /etc/sysctl.d/ for additional system variables.
	# See sysctl.conf (5) for information.

	####################### General Kernel Parameters #######################
	#kernel.domainname = example.com
	#kernel.printk = 3 4 1 3 # Uncomment to stop low-level messages on console


	####################### Kernel Hardening Parameters #####################