Why would it be 200? Imo it should be either 400 or 401.
Why would it be 200? Imo it should be either 400 or 401.
You’re right, my bad.
OP’s security concern is valid. Different CAs may differ in the challenges used to verify you to be the domain owner. Using something that you could crack may lead to an attacker’s public key being certified instead.
This could for example be the case with HTTPS verification (place a file with a specific content accessible through your URL) if the website has lacking input sanitization and/or creates files with the user’s input at an unfortunate location that collides with the challenge.
This attack vector might be far-fetched, but there can certainly be differences between different signing authorities.
Yet the review time is exponential with the size.