News for hackers. Stuff that matters.

A comment on Another free CA as an alternative to Let's Encrypt. Parent comment

Re:Another free CA as an alternative to Let's Encrypt by candiddevmike on Friday August 20, 2021 @03:46PM (#28250571)
A little off topic, but since most of ACME/Let's encrypt leverages DNS for validation (directly or indirectly to find well known host IP), why can't we just skip all of this nonsense and do validated self signing using DNS via DANE?
[ Parent | on HN ]
Re:Another free CA as an alternative to Let's Encrypt by throw0101a on Friday August 20, 2021 @04:19PM (#28250934)
You can put certificates (signatures) in DNS so that clients can look up the appropriate record and verify that certificate that the (e.g.) web server is sending matches:

* https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

However, DNS records themselves are not protected by default: they can be fiddled with in transit. So you have to enable DNSSEC to prevent them from being altered.

So yes, there are standards in place to do what you are suggesting. You'll 'just' have to convince people to enable all of this infrastructure and then have TLS clients use it.

[ Parent | on HN ]
Re:Another free CA as an alternative to Let's Encrypt by tptacek on Saturday August 21, 2021 @11:47AM (#28257909)
Which isn't going to happen; DNSSEC and DANE were introduced in browsers several years ago, and the browser developers withdrew support. These are dead-letter standards.
[ Parent | on HN ]