I know of at least 2 DNS resource record types that serve the purpose of enabling domain owners the ability to control approved/revoked certificates either self-signed or by CA's namely the CERT and TLSA RR. I'm not sure if there are other fields that basically do this, but why have both when just one will suffice?

  • Those records do not do the same thing. Did you not read their RFCs? – Michael Hampton Mar 10 at 6:06
  • @MichaelHampton does CERT not store an approved and revoked certificates list? And is the TSLA RR not a record for DANE which basically stores a digest of an approved certificate? – MShakeG Mar 10 at 6:10
  • "enabling domain owners the ability to approve/revoke certificates either self-signed or by CA's" this is certainly not what you can do with a CERT record type. – Patrick Mevzek Mar 10 at 6:11
  • 1
    As Michael said you may want to start by reading the relevant RFCs: 4398 for CERT (that superseded 2538 written in March 1999) and 6698 for core TLSA (august 2012). You can easily see that one just defines a record in the DNS without any specifications on how it can be used, where the other is a full "framework" or ecosystem where the DNS record is just one part of a bigger scheme (called DANE for what is worth). – Patrick Mevzek Mar 10 at 6:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.