3 ms·
That's what the CAA dns records are meant to prevent. It tells Certificate Authorities which of them are allowed to issue for your domain. Couple that with mos
by tomschlick 9y ago
That's what the CAA dns records are meant to prevent. It tells Certificate Authorities which of them are allowed to issue for your domain.
Couple that with most providers requiring you to prove your domain via DNS or organizational status and you narrow the attack window.
Also I'd assume that as the owner of a domain, you'd be able to revoke any certificate for your domain that you didn't create.
- foota 9y agoMaybe that's the piece of the puzzle that's missing here? Being able to revoke a cert automatically by proof of domain ownership?
- tomputer 9y agoThat is mostly true, unless it's malicious Certificate Authority which may, on behalf of a governments request, ignore the CAA record on purpose to generate a certificate. This is where a TLSA record would help to prevent malicious certificates. At least, if the client (browser) validates TLSA records.