2 ms·
Not necessarily true https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization?wprov=sfti1 https://en.wikipedia.org/wiki/DNS_Certification_Authori
by aaomidi 6y ago
Not necessarily true https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization?wprov=sfti1 https://en.wikipedia.org/wiki/DNS_Certification_Authority_Au...
- benlivengood 6y agoFrom the RFC: Relying Parties MUST NOT use CAA records as part of certificate validation. A normal user is in roughly the same situation with and without CAA; is a particular certificate trustworthy? Only trusted root CAs and CRLs can answer the question. CAA is only cryptographically secure with DNSSEC, and transparency reports give at least as much auditability.