Why TLS 1.3 isn't in browsers yet

Re:Why TLS 1.3 isn't in browsers yet by DKnoll on Thursday December 28, 2017 @08:39AM (#16021915)

HSTS only says connections must be encrypted, not with which cert... you're thinking of a CAA record. Although a CAA record doesn't mean much if your adversary controls the DNS server.

[ Parent | on HN ]

Re:Why TLS 1.3 isn't in browsers yet by yrro on Friday December 29, 2017 @11:02AM (#16030080)

I think you're thinking of HTTP Public Key Pinning. A CAA record just tells a CA whether it is permitted to issue certificates for a domain.

[ Parent | on HN ]

Re:Why TLS 1.3 isn't in browsers yet by DKnoll on Friday December 29, 2017 @11:19AM (#16030181)

Well actually I think you mean... no just kidding. Thanks for the correction. I thought CAA records would also tell clients if a trusted root was also trusted for that domain.

[ Parent | on HN ]