3 ms·
You know, the main job for a web CA is to verify the owner of a domain. What if... domain registrars had that job instead? They definitively know the domain reg
by 0x0 10y ago
You know, the main job for a web CA is to verify the owner of a domain. What if... domain registrars had that job instead? They definitively know the domain registrant, no need to play games with email verification tokens or http challenges.
- gruez 10y agothat's pretty much DNSSEC/DANE
- tomc1985 10y agoand then hope that every registrar out there is honest...
- 0x0 10y agoNot really, it could be set up so registrar CAs would only be valid for domains they are registrars for. Then you just need to pick one trustworthy registrar for your own domains, and you're set. If you can't trust your registrar with your domains, you have bigger problems anyway.
- inopinatus 10y agoDomain registries & registrars do not generally verify the identity of the registrant. It can occur, but only if trademark protection mechanisms are invoked. By testing the DNS, you really verify the domain operator, which in practice means anyone who can update the NS/DS/glue records. It's arguably quite a weak assertion. Similarly this explains why DV certificates are cheap and EV certificates are less cheap.
- 0x0 10y agoI was talking about DV certificates. The registrar is in the perfect position to provide this. You could probably even set it up so nobody but the real registrar can issue certificates for a given domain, as opposed to the current free-for-all.