> That's kind of the thing that certificate validation is supposed to solve, an attacker posing as you [...]
No, not really. Certificates get issued to hostnames and less frequently, IP addresses. If someone has full control over that resource then what's the actual difference between "you" and "attacker"? Should they run a malware scan too that your server is not compromised?
It's not a thing a CA can solve if you've completely lost control of your infrastructure.
No, not really. Certificates get issued to hostnames and less frequently, IP addresses. If someone has full control over that resource then what's the actual difference between "you" and "attacker"? Should they run a malware scan too that your server is not compromised?
It's not a thing a CA can solve if you've completely lost control of your infrastructure.