40 ms·
Somewhere tptacek is in tears, and laughing.
by ohyeshedid 8y ago
Somewhere tptacek is in tears, and laughing.
- masklinn 8y agohttps://twitter.com/tqbf/status/1116112320567087104 https://twitter.com/tqbf/status/1116112320567087104
- dcbadacd 8y agoJust like you can f* up HTTPS when you have Strict Transport Security, you can f* up DNSSEC. While I don't really like current DNSSEC implementations, this is not DNSSEC's fault really. The idea I do like, that recursive resolvers can't tamper my resolving - that the recursive resolver is left out of the trust chain.
- kadendogthing 8y agoI can't wait to see what disingenuous statements he makes about a config failure.
- belorn 8y agoDNS delegation errors are kind of rare. There are so many configuration errors in web deployment, and the most common errors I see which causes websites to be inaccessible are misconfigured certificates where: • You get the default certificate for the web server rather than the correct one for the vhost. • You have a redirect from www->bare or bare->www and the redirect vhost don't have a certificate. • The certificate don't include the www subdomain name. • A wild card certificate doesn't include the bare name. • There are multiple web servers listed in DNS but only a subset has a correct HTTPS configuration.