cpburns2009 2 hours ago

It's a strange liability that every trusted CA is authorized to sign certificates for every possible domain, even ones it has no right signing. It would make more sense for them to be limited to a set of TLD/ccTLD.

▲

throwaway7356 2 hours ago | parent | next [-]

> even ones it has no right signing

They have that right though? There is no monopoly to single CAs for a given domain.

▲

cpburns2009 an hour ago | parent [-]

Why should podunk CAs be trusted by default to sign google.com when that's not their intended purpose?

▲

throwaway7356 an hour ago | parent [-]

Because managing a listing of each domain and the set of the CAs that have the "purpose" to sign certificates for that domain is not very practical. The problem is that there are more than 20 domains.

	▲	VMG 15 minutes ago \| parent [-]
		Right but there are probably 100-1000 important domains and a long tail of less important ones

▲

ImJamal an hour ago | parent | prev [-]

Isn't that the purpose of CAA? You can choose which CAs can sign a cert for your domain?