Randy Bush <randy@psg.com> writes:
Which is the reason why no major browser does TLSA validation.
well. there is the extra protocol turn. agl tried and backed off, seemingly because of that.
I hear that. And I see them pushing DNS over HTTPS at the same time. Doesn't really compute... They are so good at making up excuses. A couple of yours ago they didn't need TLSA validation beacuse HPKP was so much better: https://www.imperialviolet.org/2015/01/17/notdane.html Where did that go? Oh, yes, turns out it wasn't such a good idea anyway: https://ordina-jworks.github.io/security/2018/02/12/HPKP-deprecated-what-now... So now we're back to ultimate trust in the CAs again, using CT and CAA. Nice move.
but, if we want to encourage tlsa, recommended values for the three lovely but obscure (after all, it is the dns) parameters. victor whacked me into using 211 with let's encrypt certs.
I prefer 3 1 1 for my certs, pinning my own key regardless of who else signed it. Bjørn