Re: [keyassure] CN/SAN matching (was: End entity certificate matching, trust anchors, and protocol-06)

[Peter Palfrader <[e-mail]>]

On Mon, 21 Mar 2011, Jakob Schlyter wrote:

> On 21 mar 2011, at 10.25, Peter Palfrader wrote:
> 
> > Updating the certificate and its corresponding binding in DNS is not
> > dissimilar to updating DNSKEY and DS records: care must be taken to get
> > the timing right, so that's a potential source of error.
> 
> Update TLSA resource records is very different from update DNSKEY et
> al. - as long as you take the TTL into consideration, you can update
> as you wish.

Create a new cert, create its hash, send to the DNS guys for inclusion.
Wait TTL.
Deploy new cert.
Mail the DNS people that they can now remove the old hash.

That's not really something you want to have to do all that often.

> > But even if we do require SNI for TLSA to be useful with virtual
> > hosting, that still means a virtual hosting provider has to create a
> > certificate for each of the domains they want to serve[2].
> 
> Yes, why would that be a problem?

Why is it needed in the first place?

-- 
                           |  .''`.       ** Debian **
      Peter Palfrader      | : :' :      The  universal
 http://www.palfrader.org/ | `. `'      Operating System
                           |   `-    http://www.debian.org/