3 ms·

Maybe, but today's DV PKI is already trusting DNS 100%, since certificates are issued based on using DNS responses to validate the certificate request. If you d

by 0x0 9y ago

Maybe, but today's DV PKI is already trusting DNS 100%, since certificates are issued based on using DNS responses to validate the certificate request. If you don't trust the governing body of a specific ccTLD, for example, you are already worse off today - a hostile ccTLD DNS operator could very well arrange to fake DNS responses for the duration of a certificate request? Maybe it's not so bad to make it more obvious what a fancy .ly or .lol TLD really stands for?

toast0 9y ago
Even non DV PKI uses a lot of trust of the DNS. Where I work, I got our first non-DV certificate issued, and while the CA verified our organization exists (and made our certs show the city listed in our corporation filing instead of the city I wanted to show), the only reason they issued certificates to me is because I did essentially Domain Validation for the domain.
- 0x0 9y ago
  Yep, it's a race to the bottom for CAs to perform the absolute minimum work necessary, because otherwise competitors come in and make things easier for customers. Paying a premium for the services of a stricter CA currently has no benefits, since end-users have no way to evaluate whether a certificate is legitimate vs sloppily or maliciously issued by a different CA. Funny thing about ccTLDs are that end-users might actually have some sort of opinion one way or the other about their trustworthyness, foreign or not. At least a tld is somewhat more visible and relatable in URLs compared to unfamiliar CA company names.
  - jaas 9y ago
    "it's a race to the bottom for CAs to perform the absolute minimum work necessary" I can assure you that we, Let's Encrypt, are not doing the minimum. We are headed in quite the opposite direction. It's not easy to keep things simple while improving security but it can be done.
    - 0x0 9y ago
      Sorry, I was mostly having the various commercial EV services in mind for that comment. Thanks for all the great work your team seems to be consistently doing!

by 0x0 9y ago

toast0 9y ago

Even non DV PKI uses a lot of trust of the DNS. Where I work, I got our first non-DV certificate issued, and while the CA verified our organization exists (and made our certs show the city listed in our corporation filing instead of the city I wanted to show), the only reason they issued certificates to me is because I did essentially Domain Validation for the domain.

0x0 9y ago
Yep, it's a race to the bottom for CAs to perform the absolute minimum work necessary, because otherwise competitors come in and make things easier for customers. Paying a premium for the services of a stricter CA currently has no benefits, since end-users have no way to evaluate whether a certificate is legitimate vs sloppily or maliciously issued by a different CA. Funny thing about ccTLDs are that end-users might actually have some sort of opinion one way or the other about their trustworthyness, foreign or not. At least a tld is somewhat more visible and relatable in URLs compared to unfamiliar CA company names.
- jaas 9y ago
  "it's a race to the bottom for CAs to perform the absolute minimum work necessary" I can assure you that we, Let's Encrypt, are not doing the minimum. We are headed in quite the opposite direction. It's not easy to keep things simple while improving security but it can be done.
  - 0x0 9y ago
    Sorry, I was mostly having the various commercial EV services in mind for that comment. Thanks for all the great work your team seems to be consistently doing!