News for hackers. Stuff that matters.

A comment on Calling time on DNSSEC: The costs exceed the benefits. Parent comment

Re:Calling time on DNSSEC: The costs exceed the benefits by patmcc on Saturday June 03, 2023 @04:09AM (#36174680)
Regardless of protocol, yes only one person/org should be in control of (and able to obtain certs for) a particular domain.

Unless you're suggesting Person A should have port 443 on www.something.com and Person B should have port 444, and each gets their own (valid) www.something.com cert? Because that some very clear problems.

[ Parent | on HN ]
Re:Calling time on DNSSEC: The costs exceed the benefits by donttellmypeers on Saturday June 03, 2023 @04:26AM (#36174777)
Generally services not found directly at A/AAAA records for a name are found via another record that contains a hostname (HTTPS/SVCB, SRV, etc) at a leaf node below the name. So `_xmpps-server._tcp.example.net` might contain the hostname `hosted-provider.example.com` in which case `hosted-provider.example.com` will need to respond with a certificate for `example.net`, unless you trust the DNS, in which case it can respond as `hosted-provider.example.com`.
[ Parent | on HN ]