3 ms·

How the authenticity of IP address is established then? Wouldn’t the server need a certificate for its IP?

• corty 6y ago
  Either for its IP or for the hostname that results from the reverse-lookup of the IP. The latter is easier to obtain (proof of ownership for IPs is cumbersome) and is often present anyways. It would need an additional DNS lookup, but the present suggestion involving SVCB would need that as well (along with all the other uglyness).
  • belorn 6y ago
    Add some dnssec and ipsec keys to the reverse-lookup zone and we have everything we need to authenticate the IP address.
  • ameshkov 6y ago
    Proving IP address ownership is done via HTTP challenge, nothing too problematic.