Recherches récentes
Options de recherche
Why isn't the SSL cert for a server a special kind of DNS record?
@R1Rail@pouet.chapril.org@evan You can achieve this with the TLSA RR (and then you must use DNSSEC to guarantee - up to a certain kind of certainty - that the genuine DNS answer is returned)
@R1Rail That's interesting! I will see if I can give it a try.
@evan However, I do not know web browsers looking for it. Postfix does for encrypting mail server to mail server communication, when it is properly configured
@R1Rail @evan The DANE (DNS-based Authentication of Named Entities) standard
1) Relies on DNSSEC which has been really slow to adopt
2) Requires integration on both client and server side
3) Would also require a radical shift by the entire Internet away from the existing PKI based trust model
It’s never going to happen.