News for hackers. Stuff that matters.

A comment on Why CISA Issued Our First Emergency Directive. Parent comment

Re:Why CISA Issued Our First Emergency Directive by tptacek on Sunday February 17, 2019 @02:17PM (#19186259)
Can you confirm another CA other than LetsEncrypt that will reliably deny issuance on a DNSSEC failure?

(Obviously, just to point something out for the thread that you already know, the vast, overwhelming majority of LetsEncrypt issuances are for zones without DNSSEC signatures).

[ Parent | on HN ]
Re:Why CISA Issued Our First Emergency Directive by tialaramex on Sunday February 17, 2019 @06:13PM (#19187502)
Given that I already wrote that...

> I haven't used them and so can't even tell you from my own experience how well they work

... I'm not sure what my "confirmation" would tell you, beyond that I know how to read the paperwork from the CAs. But sure, both Sectigo and DigiCert say their systems should deny issuance on DNSSEC failure.

[ Parent | on HN ]
Re:Why CISA Issued Our First Emergency Directive by tptacek on Sunday February 17, 2019 @09:13PM (#19188186)
I'm asking because I want to know, not to make a point.
[ Parent | on HN ]