From my understanding DNSSEC allows me to create a public key and sign my DNS records. There appears to be multiple ways to have a certificate record (such as DANE see https://wiki.mozilla.org/Security/DNSSEC-TLS-details#Embedding_Certificate_Information_in_DNS)
I'm not exactly sure how this works. I'm guessing these steps. Is this correct?
- Create a public/private key pair
- Put the public key into a DNS record (DS I believe)
- Sign my dns records
- Create a public/private key for my server
- Create a certificate
- Sign the certificate using the DNS private key
- Put the certificate in the DNS!?!?!
- Put the certificate on my server and use it the typical way?
I feel like I got something wrong and that Mozilla link mentions not all records would be supported so which is currently well supported (lets say firefox, chrome, IOS and android) and what record am I using for what I describe? DANE? CAA?