Re: DNSSEC and SSL

[Mikael Abrahamsson <swmike () swm pp se>]

On Sat, 21 Aug 2010, ML wrote:

> Would a future with a ubiquitous DNSSEC deployment eliminate the market
> for commercial CAs?

No, but it might eliminate the cheapest certs that people might use. I'd 
like my personal server to have a self-signed cert with it's fingerprint 
handled via DNSSEC, because I don't want to pay a CA.

> Would functioning DNSSEC + self signed certs be more secure/trustworthy 
> than our current system of trusted CAs chosen by OS/browser developers?

No, because DNSSEC isn't secured all the way from the DNS server to the 
application, only to the resolver. Both systems have problems, I'd imagine 
the best security is when they work together.

--
Mikael Abrahamsson    email: swmike () swm pp se