4 ms·
I’m not totally sure but I’m guessing the question is basically “why not skip the middleman CA and just trust whoever controls the domain directly?” and the rea
by dilyevsky 5y ago
I’m not totally sure but I’m guessing the question is basically “why not skip the middleman CA and just trust whoever controls the domain directly?” and the reason is you can’t be sure if example.com is actually who it says it is bc DNS is easily spoofable (e.g by your isp or a local government). ACME works because the challenge is exchanged offband
- sreevisakh 5y agoIsn't DNSSEC supposed to solve the spoofing problem?
- dilyevsky 5y agoYes but then you still need a trusted third party for clients to trust it. Now you’re back to proving to that third party that you really do own the domain
- tomjen3 5y agoBut I can get a signed key using a DNS challenge.
- dilyevsky 5y agoYes but then you need to spoof it to the CA itself which is harder. They also publish every cert they sign in transparency logs so the owner can monitor for any funky business