Re:Another free CA as an alternative to Let's Encrypt
by throw0101a on Friday August 20, 2021 @04:19PM
(#28250934)
You can put certificates (signatures) in DNS so that clients can look up the appropriate record and verify that certificate that the (e.g.) web server is sending matches:
However, DNS records themselves are not protected by default: they can be fiddled with in transit. So you have to enable DNSSEC to prevent them from being altered.
So yes, there are standards in place to do what you are suggesting. You'll 'just' have to convince people to enable all of this infrastructure and then have TLS clients use it.
Re:Another free CA as an alternative to Let's Encrypt
by tptacek on Saturday August 21, 2021 @11:47AM
(#28257909)
Which isn't going to happen; DNSSEC and DANE were introduced in browsers several years ago, and the browser developers withdrew support. These are dead-letter standards.
* https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...
However, DNS records themselves are not protected by default: they can be fiddled with in transit. So you have to enable DNSSEC to prevent them from being altered.
So yes, there are standards in place to do what you are suggesting. You'll 'just' have to convince people to enable all of this infrastructure and then have TLS clients use it.