News for hackers. Stuff that matters.

A comment on Around 293 intermediate CAs in violation of CA/Browser guidelines. Parent comment

Re:Around 293 intermediate CAs in violation of CA/Browser gu... by ocdtrekkie on Monday July 06, 2020 @09:36AM (#23747707)
DNS providers should be your HTTPS providers though. Presumably the certs your browser would have to "just know" would be for the root TLDs, so you could verify with them what DNS provider a given domain was entrusted to, and then query that DNS provider whether or not your domain's certificate was legitimate.

The idea that any CA can issue a valid cert for any domain is the heart of what's wrong with PKI.

[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by brohee on Monday July 06, 2020 @02:24PM (#23751029)
The name constraint extension (https://tools.ietf.org/html/rfc5280#section-4.2.1.10) can help a lot with that, we chose to trust CA for all names but we could have had CAs for a way more limited set of domains.

Software support is far from universal sadly.

[ Parent | on HN ]