3 ms·
If we get DNSSEC (or a less complicated alternative) working in widespread use then we could simply parse CAA records in the browser. That way a website owner
by zaarn 9y ago
If we get DNSSEC (or a less complicated alternative) working in widespread use then we could simply parse CAA records in the browser.
That way a website owner can whitelist only a very specific CA for their certificates.
Ideally with DNSSEC we could also get DANE and issue our own certificates and CA's would only be necessary as cosigner for OV, EV and similar.
- acqq 9y agoThe problem I describe and its easy solution are completely independent of DNSSEC.
- zaarn 9y agoDNSSEC is required to secure DNS responses which can be crucial to prevent "every crooked CA" to issue a cert for you. If CAA was interpreted by the browser, you could determine exactly which CA is trusted to issue certs for your site and DNSSEC would ensure that the browser gets the correct list of trusted CAs.