CAA `accounturi` Binding Emerges as Defense Against Fraudulent Let's Encrypt Issuance

Security researchers highlighted how attackers can obtain valid TLS certificates through domain-validation bypasses without compromising the target server, citing the 2023 jabber.ru incident in which fraudulent Let's Encrypt certificates were reportedly used to support man-in-the-middle interception of XMPP traffic. The attack was described as long-running, affecting multiple jabber.ru servers hosted in Germany, and demonstrated how control over DNS responses or network paths can enable trusted certificate issuance that appears legitimate to clients.

Guidance from Let's Encrypt and independent researchers points to CAA accounturi restrictions as a stronger control by binding certificate issuance to a specific ACME account URL, alongside DNSSEC and restrictive CAA policy. Let's Encrypt documents that account IDs are exposed as ACME account URLs and can be retrieved by clients such as Certbot, enabling operators to configure these bindings and report issues accurately. Researchers also urged organizations to monitor Certificate Transparency logs, compare logged certificates with locally deployed certificates, and use external certificate and TLS-fingerprinting checks to detect unauthorized issuance and possible MITM activity earlier.