Post #2447681
2026-05-08 21:18 UTC
@SRAZKVT@tech.lgbt Yes, DANE makes the CA cartel middle-men obsolete.
Rather than you proving to the CA that you own your domain via DNS entries you set (and can cryptographically protect), and the CA signing your key to say "yes this key belongs to the owner of the domain"..
You just publish your own key in DNS, protected by DNSSEC, using the fact that you have authority over the contents of your own domain's DNS entries.
Full adoption would eliminate so many layers of awfulness. And slimy middle-men's business models.
Replies (2)
-
@i@toot.pouyan.net 2026-05-08 21:25
@dalias@hachyderm.io @SRAZKVT@tech.lgbt to be fair. DANE would only replace domain validated certs. If a cert contains any other data, e.g. company name, I'd still prefer a trusted third party that can verify and vouch for the correctness of that info. I'm not saying that CAs are doing a good job on that front, but I'd argue that EV certs have their own merits.
-
@stiiin@infosec.space 2026-05-08 21:25
@dalias@hachyderm.io @SRAZKVT@tech.lgbt You're missing one more thing to be done server-side: support the TLS DNSSEC Chain Extension (IETF RFC 9102). Because a browser can't rely on the operating system (and/or whichever DNS resolver the computer ends up consulting) to verify or even supply DNSSEC signatures.