3 ms·
It would solve the problem partially. Currently, every trusted CA can issue a certificate for any domain. Registries would be limited to tampering with the TLDs
by blfr 12y ago
It would solve the problem partially. Currently, every trusted CA can issue a certificate for any domain. Registries would be limited to tampering with the TLDs they control.
You wouldn't need to worry that DigiNotar or China Internet Network Information Center start issuing certs for your domain unless you're using .nl or .cn. The TLD itself would be a visible indicator of how much trust a user should offer.
- markild 12y agoAbsolutely. I would be a huge improvement. I'm thinking more in the lines of stopping three-letter agencies from doing MITM. I don't know if it's actually possible to prove the integrity of the root nodes.