2 ms·
A little off topic, but since most of ACME/Let's encrypt leverages DNS for validation (directly or indirectly to find well known host IP), why can't we just ski
by candiddevmike 5y ago
A little off topic, but since most of ACME/Let's encrypt leverages DNS for validation (directly or indirectly to find well known host IP), why can't we just skip all of this nonsense and do validated self signing using DNS via DANE?
- throw0101a 5y agoYou can put certificates (signatures) in DNS so that clients can look up the appropriate record and verify that certificate that the (e.g.) web server is sending matches: * https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities#TLSA_RR https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na... However, DNS records themselves are not protected by default: they can be fiddled with in transit. So you have to enable DNSSEC to prevent them from being altered. So yes, there are standards in place to do what you are suggesting. You'll 'just' have to convince people to enable all of this infrastructure and then have TLS clients use it.
- tptacek 5y agoWhich isn't going to happen; DNSSEC and DANE were introduced in browsers several years ago, and the browser developers withdrew support. These are dead-letter standards.