cpach

You can also read a lot of anti-Trump articles and comments on countless web-sites, some under .com and some under other top-domains. As lunatic as Trump is, he hasn’t shut that down.

“Is the TLD root management really split up vertically”

AFAIK, yes, it is.

But if the global DNS would somehow break down I guess you either have to find an alternative set of root servers. Or communicate outside of the regular Internet. Such an event surely would shock the global economy.

ZeroSSL/HID Global seems to be quite multi-national though, and it’s owned by a Swedish company (Assa Abloy).

I don’t know what what kind of mitigations these orgs have in place if the shit really hits the fan in the US. It’s an interesting question for sure.

It depends. If the ACME client is configured to only use Let’s Encrypt, then the answer is yes. But the client could fall-back to Google’s CA, ZeroSSL, etc. And then there is no single point of failure.

If it’s time to do the task but it’s so big that I cannot do it directly I will create a Jira ticket for it.

When the task is done I either remove it from the list, or bump the due date if it’s a recurring task.

Most people have never heard of it and never used it.

People who are serious about security use newer, better tools that replace GPG. But keep in mind, there’s no “one ring to rule them all”.

One option is to build your own PKI with it’s own root certificate, and then tell all involved parties to import that into their root cert stores.

That’s a lot of work though. If you want to, I think you can buy “private-PKI-as-a-service” from companies like Digicert and Sectigo. And probably from AWS/Google/Azure too.

I don’t know the specifics of your environment but it might also be possible to do encryption and signature verification above the transport layer. I.e. sign (and possibly encrypt) the payload itself. Then you might not need mTLS for the connection itself.

https://hsm.tunnel53.net/article/dns-for-acme-challenges/