3 ms·

Thanks for another clear explanation of process! But... the fact that there isn't some standardized automated revocation procedure that all CAs are required to

• tptacek 7y ago
  You're thinking of CAA, which in theory works even if only the CAs look at the records, which is important because no browser will; all mainstream browsers have abandoned DNSSEC, which is moribund.
• tialaramex 7y ago
  Getting the CAs to all agree on some particular process is like herding cats. In practice the situation where you'd want this is relatively uncommon, so it's as though you demanded US States all come up with a single unified set of traffic regulations - most Americans do not routinely drive in more than one or two states and so they'd support their home state in insisting that whatever happens it should be spared the expense of changing. It would go nowhere. You can use CAA to tell CAs whether they're authorised to issue for names in your domain, and since CAA is a DNS resource you can secure it with DNSSEC. But CAA isn't retrospective, it won't magically revoke certificates which already exist, although it could prevent issuance based on stale authorisations because it's supposed to be checked live. Using DANE here would be pretty fraught even if it was widely deployed which is far from the truth.