3 ms·
> At the very, very least I should be able to pin which CAs I trust so the threat vector doesn't include every CA in the world. You can do this with CAA record
by dantiberian 9y ago
> At the very, very least I should be able to pin which CAs I trust so the threat vector doesn't include every CA in the world.
You can do this with CAA records today, to restrict which CAs can issue certificates for your domain.
- lol768 9y agoThis always seemed backwards to me. If the worry is that certs are being misissued, why on earth are we assuming that such CAs are following the rulebook? No, the browser should check the CAA record and refuse to trust certs issued by the wrong CA.
- pfg 9y agoThis would only make sense under the assumption that the DNS response can be trusted. For the vast majority of domains and resolvers, that would not be the case. (I'm skipping the discussion of whether you'd want to trust DNSSEC at all.) The idea you're describing has been standardized as DANE, which has failed to gain any adoption. It would not make sense for CAA to try to do the same thing. Instead, it set out to provide a defense-in-depth mechanism for certain CA vulnerabilities that fall short of a full compromise.