Re:Statement on DNS Encryption [pdf]
by 1vuio0pswjnm7 on Thursday April 22, 2021 @04:56PM
(#26908091)
"I said a certificate with a name is better than a certificate with an IP."
I think that's debatable. IMO, it depends in part on the perceived value of the ICANN "domain name business" as some sort of vetting mechanism. In this case the party being vetted is ICANN itself. Although they did pay for "EV".
Here is a question for the TLS certificate fanatics: Why do CAs provide non-http URLs to their CA certificates in the certificates they sell. For example,
I suspect it is a bootstrapping issue. At the top of the chain there is some notion of implict trust. No different than with DNS. Trust should be decided by the end user not by developers, nor by some self-appointed "authority".
I think that's debatable. IMO, it depends in part on the perceived value of the ICANN "domain name business" as some sort of vetting mechanism. In this case the party being vetted is ICANN itself. Although they did pay for "EV".
https://censys.io/ipv4/192.0.32.9/raw
Does Globalsign still offer certificates that are tied to IP addresses.
https://support.globalsign.com/customer/portal/articles/1216...
Here is a question for the TLS certificate fanatics: Why do CAs provide non-http URLs to their CA certificates in the certificates they sell. For example,
http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1.crt
I suspect it is a bootstrapping issue. At the top of the chain there is some notion of implict trust. No different than with DNS. Trust should be decided by the end user not by developers, nor by some self-appointed "authority".