Parallel Reconstruction of Lawful TLS Wiretapping | Hacker News

A Hacker News thread discussed whether rerouted traffic for jabber.ru could let an attacker obtain a valid TLS certificate through normal issuance, without compromising a CA.

Commenters debated how well Certificate Transparency can expose this kind of interception, and whether an attacker could conceal it or later blame it on a server compromise.

The discussion also focused on DNSSEC, ACME, and CA policy limits as possible defenses against traffic redirection and unauthorized certificate issuance.

The topic matters because state actors or attackers may use BGP leaks or similar rerouting to obtain legitimate certificates and make TLS interception harder to detect.