4 ms·
Or perhaps do it the other way around? Make a Let's Encrypt subdomain-blacklisting TXT record with which the parent domain could indicate that they don't want s
by nippoo 11y ago
Or perhaps do it the other way around? Make a Let's Encrypt subdomain-blacklisting TXT record with which the parent domain could indicate that they don't want subdomain owners to be able to create their own SSL certificates. (Useful in the case of hosted web services, for example, where the parent already owns a wildcard certificate so there's no reason for the subdomain to create one)
- pfg 11y agoThis is already possible using CAA DNS records, which can be used to define which CAs should be permitted to issue certificates for a domain.
- tremon 11y agoThat's great. But according to https://tools.ietf.org/html/rfc6844 https://tools.ietf.org/html/rfc6844, this is quite recent, and not standardized yet. Do you have any information on which CA's already support this, or whether Let's Encrypt (intends to) support this? I'm still hoping for DANE to gain traction, though. Not necessarily as a replacement for CA's; there is value in thorough, third-party validation of certificates, but not within the current ecosystem.
- pfg 11y agoYes, Let's Encrypt does support CAA. Not sure about other CAs.