3 ms·
Not really superior if no one uses because they can't figure it out.
by otikik 4y ago
Not really superior if no one uses because they can't figure it out.
- bombolo 4y agoWell the current system we basically sign everything as long as the domain on the certificate matches what's registered on the DNS. If the certificate says "Company AB", nobody checks if that's true.
- tialaramex 4y agoIf the certificate says "Company AB" the CA is required to check that's true, there's a set procedure to do so. If you ask Let's Encrypt for a certificate saying "Company AB" they won't give it to you, because they don't follow such procedures and so they know they can't issue such certificates. But, this is not very useful because: * Consumers generally have no idea who "Company AB" are. You wanted funny-cat-gifs.example not "VXK Enterprise LLC of New Jersey" who might happen to run funny-cat-gifs.example. Lots of famous brands are actually offered by companies with unrelated names, so then you're asking the CA to vouch for the brand name, which is an extra layer of indirection... * Jurisdiction is a thing. Maybe I trust Greasy Geoff's Cider And Pork, but alas I was thinking of the Kansas Greasy Geoff's, not the one from Missouri. * Machines can't do anything with this so it's only useful in the rare case a human spent time thinking about it, whereas the DNS name check is something the machine cares about for every single HTTP transaction, of which often several per second happen.