4 ms·
This is already possible using CAA DNS records, which can be used to define which CAs should be permitted to issue certificates for a domain.
by pfg 11y ago
This is already possible using CAA DNS records, which can be used to define which CAs should be permitted to issue certificates for a domain.
- tremon 11y agoThat's great. But according to https://tools.ietf.org/html/rfc6844 https://tools.ietf.org/html/rfc6844, this is quite recent, and not standardized yet. Do you have any information on which CA's already support this, or whether Let's Encrypt (intends to) support this? I'm still hoping for DANE to gain traction, though. Not necessarily as a replacement for CA's; there is value in thorough, third-party validation of certificates, but not within the current ecosystem.
- pfg 11y agoYes, Let's Encrypt does support CAA. Not sure about other CAs.