Hacker News new | past | comments | ask | show | jobs | submit login

To cause grief for a CA you don't much like?

I'm taking issue with the idea of checking CAA records against CT logs after the fact as a means of verifying CA compliance with CAA.




The idea isn't for third parties to check CT logs against CAA records. Instead, the idea is for the domain owner to check CT logs to detect CAs issuing certs that shouldn't be there.

This is orthogonal to CAA records. You can check CT logs without having a CAA records, and CT logs can also be used to detect misbehavior from a CA you authorized in your CAA records. At the same time, CAA records are preventative, whilst CT logs only allow detection after the fact.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: