3 ms·
> Interests of the existing PKI industry may be the source of some friction, but the bigger issue is that DANE depends on DNSSEC, which is not widely deployed,
by PunchyHamster 6mo ago
> Interests of the existing PKI industry may be the source of some friction, but the bigger issue is that DANE depends on DNSSEC, which is not widely deployed, and sometimes actively avoided due to its complexity and ease of breaking you site.
I have a feeling it is "actively avoided" because vendors don't want to lose control of the cert ecosystem. Allowing user to just generate a domain for themselves means it will never get logged in central log and so can't be automatically found by crawlers by the big guys
- xorcist 6mo agoThis is public data so the big guys could absoltely crawl it. But we should not underestimate the size of the PKI industry, several large actors make good living from the existing web PKI and they will not change unless their very existence is threatened.
- Parodper 6mo ago> Allowing user to just generate a domain for themselves That's limited mostly by policy[1], the current PKI environment already allows delegating CA for a single domain. [1] https://community.letsencrypt.org/t/sub-ca-with-wildcard-certificate/237578/8 https://community.letsencrypt.org/t/sub-ca-with-wildcard-cer...
- PunchyHamster 6mo agoLast time I checked support for that on client side was pretty spotty
- tptacek 6mo agoThere is no support for DANE on the client side!