Hacker News Reader

cpburns2009

It's a strange liability that every trusted CA is authorized to sign certificates for every possible domain, even ones it has no right signing. It would make more sense for them to be limited to a set of TLD/ccTLD.

View on HN

Isn't that the purpose of CAA? You can choose which CAs can sign a cert for your domain?

CAA records are requested and used only by certificate authorities. They might as well not exist for web browsers (they don't even look for them). Maybe that should change?

I believe DANE addresses this (and other things, which is what makes it complicated).

> even ones it has no right signing

They have that right though? There is no monopoly to single CAs for a given domain.

Why should podunk CAs be trusted by default to sign google.com when that's not their intended purpose?

Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains.

Right but there are probably 100-1000 important domains and a long tail of less important ones

Reply on news.ycombinator.com