4 ms·
If we are talking about obtaining DV certificates, then why do you bring up the connection between a browser and Google DNS? The good thing about Google doing
by phicoh 8y ago
If we are talking about obtaining DV certificates, then why do you bring up the connection between a browser and Google DNS?
The good thing about Google doing DNSSEC validation that on average zones can either be unsigned or need to have valid signatures.
By signing your own domains with DNSSEC and assuming CAs do DNSSEC validation you can protect your own domains from malicious DV certificates.
That's a nice feature. If you don't like DNSSEC, nobody is forcing you to sign your zones. I can still sign my zones even if you don't sign yours.
The next step would be for CAs to honour DANE records.
- tptacek 8y agoYou brought it up, not me.