3 ms·
If you’re talking about shared hosting, yes, it wouldn’t be covered by this model. But other than that, if I have a cert fo xyz.com, and I abandon the domain,
by strogonoff 5y ago
If you’re talking about shared hosting, yes, it wouldn’t be covered by this model.
But other than that, if I have a cert fo xyz.com, and I abandon the domain, even if you buy it you’ll be forced to issue another cert for it.
If it was recorded somewhere that xyz.com = my cert, it could serve as a mechanism to verify that given URL is at least is supposed to be under my control and a warning could be shown if another certificate is being served now.
Kind of like HPKP, but with longer lifetime (longer than domain name registration term) and a centralized registry tracking certificate:domain mappings rather than each individual user agent cache.
Obviously, no one would adopt it due to being a devops nightmare.
- account42 5y agoRight, you can pin the certificate or the public key in it - but that's much more specific than the entity that the cert is issued to and as you correctly noted is not practical for browsers to do automatically since keys and certs do get rotated without a change in owner.