Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes, but that is only a challenge-response DNS verification.

What I’m looking for is "I write a value into DNS once, and use that to prove at any future point at which it exists that I still control the DNS".

In this example, by putting an RSA public key in there. (the very same I use for the CSR)



I've suggested this on the ACME list, actually; allowing people to put their ACME account public keys in DNS, rather than the random-per-transaction challenge specified right now, which is quasi-unusable.

The problem, apparently, is that CA forum rules require that a random challenge be used. Of course this doesn't make much sense in the context of ACME, where you have a private key identifying the user account. But this obstructs the specification of a deterministic challenge for DNS, alas.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: