DNSSEC and SSL
swmike at swm.pp.se
Sun Aug 22 01:38:03 CDT 2010
On Sat, 21 Aug 2010, ML wrote:
> Would a future with a ubiquitous DNSSEC deployment eliminate the market
> for commercial CAs?
No, but it might eliminate the cheapest certs that people might use. I'd
like my personal server to have a self-signed cert with it's fingerprint
handled via DNSSEC, because I don't want to pay a CA.
> Would functioning DNSSEC + self signed certs be more secure/trustworthy
> than our current system of trusted CAs chosen by OS/browser developers?
No, because DNSSEC isn't secured all the way from the DNS server to the
application, only to the resolver. Both systems have problems, I'd imagine
the best security is when they work together.
Mikael Abrahamsson email: swmike at swm.pp.se
More information about the NANOG