2 ms·
So? If an authoritative DNS server operator is broken, only the domains below that operator (in the DNS hierarchy) could be impacted.
by teddyh 4y ago
So? If an authoritative DNS server operator is broken, only the domains below that operator (in the DNS hierarchy) could be impacted.
- rakoo 4y agoDNSSEC relies on a hierarchy of trust, with a single root zone at the top. If the root zone has issues, the whole system breaks down. In contrast, there is no unique "root CA" that can fail.
- teddyh 4y agoIf one CA fails, it can still issue certificates for all domains. You can’t avoid any bad CA by using a good CA; any other bad CA can still issue certs for your domains. The CA system as a whole can only ever be as good as its worst CA.