Show HN: CertStream – See SSL certs as they're issued in real time

Re:Show HN: CertStream – See SSL certs as they're issued in ... by tomschlick on Friday November 03, 2017 @06:51PM (#15622745)

That's what the CAA dns records are meant to prevent. It tells Certificate Authorities which of them are allowed to issue for your domain.

Couple that with most providers requiring you to prove your domain via DNS or organizational status and you narrow the attack window.

Also I'd assume that as the owner of a domain, you'd be able to revoke any certificate for your domain that you didn't create.

[ Parent | on HN ]

Re:Show HN: CertStream – See SSL certs as they're issued in ... by tomputer on Friday November 03, 2017 @07:17PM (#15622868)

That is mostly true, unless it's malicious Certificate Authority which may, on behalf of a governments request, ignore the CAA record on purpose to generate a certificate.

This is where a TLSA record would help to prevent malicious certificates. At least, if the client (browser) validates TLSA records.

[ Parent | on HN ]

Re:Show HN: CertStream – See SSL certs as they're issued in ... by foota on Friday November 03, 2017 @06:54PM (#15622765)

Maybe that's the piece of the puzzle that's missing here? Being able to revoke a cert automatically by proof of domain ownership?

[ Parent | on HN ]