Hacker News Reader

That's what the CAA dns records are meant to prevent. It tells Certificate Authorities which of them are allowed to issue for your domain.

Couple that with most providers requiring you to prove your domain via DNS or organizational status and you narrow the attack window.

Also I'd assume that as the owner of a domain, you'd be able to revoke any certificate for your domain that you didn't create.

View on HN

That is mostly true, unless it's malicious Certificate Authority which may, on behalf of a governments request, ignore the CAA record on purpose to generate a certificate.

This is where a TLSA record would help to prevent malicious certificates. At least, if the client (browser) validates TLSA records.

Maybe that's the piece of the puzzle that's missing here? Being able to revoke a cert automatically by proof of domain ownership?

Reply on news.ycombinator.com