#1629: Use DANE for server certificates --------------------------------------+------------------------------------- Reporter: eschnett | Owner: Type: enhancement | Status: new Priority: optional | Milestone: Component: EinsteinToolkit website | Version: development version Resolution: | Keywords: --------------------------------------+-------------------------------------
Comment (by knarf):
This only moves the problem: DANE needs DNS records to be signed with DNSSEC. Instead of trusting a list of CAs, applications need to trust whoever signed the DNS record (and support this in the first place). The list of applications that support this seems to be pretty short right now, according to wikipedia Chome and Firefox have a plugin, and the only other mentioned application is Irssi - an IRC client. GnuTLS also has support, but applications might not be linked against it (but against openssl instead), and I would assume they still need some support for it.
In general, DANE seems like a very good idea. For now I am afraid it looks like it would be too much trouble for a small group like us to get this implemented - with only very limited advantages. We would still need the usual certificates for all clients that don't support DANE.