Calling time on DNSSEC: The costs exceed the benefits

Re:Calling time on DNSSEC: The costs exceed the benefits by jcranmer on Saturday June 03, 2023 @01:03AM (#36173864)

> you can't limit your root to your local domain

Isn't this possible with NameConstraints?

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by bruce511 on Saturday June 03, 2023 @01:14AM (#36173920)

Thanks for the tip. I've not come across this before so will investigate further.

Thus isn't the only issue with distributing your own root, but it is a significant one.

Thanks again.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by toast0 on Saturday June 03, 2023 @01:44AM (#36174051)

NameConstraints used to break in Safari: if you didn't set them mandatory, the constraints would be ignored and you could sign anything; if you set them mandatory, the certificate wouldn't validate. But it looks like support was added in 10.13.3, circa 2018, so probably good to go.

Might break some things, and I'm not aware of any mainstream uses, but obviously it'd be really handy if it's usable.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by X-Istence on Wednesday June 07, 2023 @10:57PM (#36236620)

My place of work uses it extensively with Chrome/Firefox/Safari without issues. It's great.

[ Parent | on HN ]

Re:Calling time on DNSSEC: The costs exceed the benefits by cvalka on Saturday June 03, 2023 @08:46PM (#36181937)

It is. It is required in some countries (RU, CN).

[ Parent | on HN ]