3 ms·
Actually, a dns caa record could be of use in this scenario to at least alert the client that the traffic has been intercepted. Then again it is trivial to inte
by arpa 7y ago
Actually, a dns caa record could be of use in this scenario to at least alert the client that the traffic has been intercepted. Then again it is trivial to intercept and rewrite plain DNS requests and dns over https would also be subject to the same https mitm intercept... Maybe certificate pinning was a right idea.
- vbezhenar 7y agoCAA is for issuers, not for browsers. And yes, without DNSSEC it's easily spoofed.
- arpa 7y agoThat is true, however it could be used for CA verification also, could it not? Edit: RFC 6844 very unambigously states that it can be used for additional verification: CAA records MAY be used by Certificate Evaluators as a possible indicator of a security policy violation. Such use SHOULD take account of the possibility that published CAA records changed between the time a certificate was issued and the time at which the certificate was observed by the Certificate Evaluator.