News for hackers. Stuff that matters.

A comment on Around 293 intermediate CAs in violation of CA/Browser guidelines. Parent comment

Re:Around 293 intermediate CAs in violation of CA/Browser gu... by zeveb on Monday July 06, 2020 @10:28AM (#23748241)
> The problem with that approach is that anyone can create a certificate for any domain; so if I go to "example.com" then it's kinda hard for me to detect if my connection is being MITM'd, especially if this is the first time I'm visiting example.com.

You misunderstand what I mean: I advocate that the owner of .com be permitted to mint certificates for foo.com, bar.com, since right now the owner of .com and can point those subdomains to any host he wishes, and then generate a certificate using ACME (because he actually controls every subdomain of .com).

[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by arp242 on Monday July 06, 2020 @10:52AM (#23748527)
Oops, sorry; I misunderstood your comment. I thought that with "domain owners" you meant "the person who registered the domain" (i.e. self-signed certs).

Using DNS providers for certificates is an interesting idea; one I haven't heard before. I can't really think of any downsides of that at the moment.

[ Parent | on HN ]