3 ms·
At that point, why even have CAs? Why not just use something like DANE [1]. [1] https://en.m.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities http
by Anunayj 4y ago
At that point, why even have CAs? Why not just use something like DANE [1].
[1] https://en.m.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities https://en.m.wikipedia.org/wiki/DNS-based_Authentication_of_...
- throwaway787544 4y agoBecause it requires DNSSEC, and the impact of misconfiguring DNSSEC is unnecessarily high just to validate a certificate. Something like DANE that didn't require DNSSEC would work great I think