Hacker News new | ask | show | jobs
by corty 2010 days ago
There are CAA records in DNS, but those are far too weak. The CAs are supposed to check them at issue-time. To be useful, the clients would have to check them at acceptance-time.
1 comments

That wouldn't quite work the way you think it would...

The CAA record is useful only at the time a certificate is issued (signed) by a CA.

A client has no way to know what the CAA record was at the time the certificate was issued -- a browser cannot ("at acceptance-time") use the current value of the CAA record to determine whether a certificate was properly issued or not.