3 ms·
That's why I want to use it only for DoH/DoT queries. Which will be used by the CAs to issue the WebPKI certs. This way, it can be used to guarantee the integr
by cyberax 1y ago
That's why I want to use it only for DoH/DoT queries. Which will be used by the CAs to issue the WebPKI certs.
This way, it can be used to guarantee the integrity of the resolution path without first getting a certificate from a CA.
- tptacek 1y agoI'm just saying, at that point, you're using a custom TLS protocol, because the real TLS protocol doesn't have a DANE-stapling extension.
- cyberax 1y agoSure. But if it's used only for DoH/DoT queries inside a DNS resolver, its deployment path is more realistic than adding DANE to all the TLS clients.
- tptacek 1y agoRight, I agree with that narrow point, but it seems clear to me that neither is going to happen; I think DANE is a dead letter.