2 ms·
Automated HSTS, revokable public key pins, and certificate transparency.
by bmh_ca 9y ago
Automated HSTS, revokable public key pins, and certificate transparency.
- sofaofthedamned 9y agoAgreed, but I'd add ipv6
- dane-pgp 9y agoAgreed, but to those 4 things I'd add DANE TLSA (RFC 6698) and Certification Authority Authorization (CAA) (RFC 6844) as further lines of defence against rogue CAs.