[atlas] SSL Certificates for ripe anchors

On 8/30/19 2:36 PM, Sander Steffann wrote:

> Hi,
>
>> Hold your horses, self-signed cert with proper TLSA records in
>> DNSSEC-signed domain is even better, see
>> https://tools.ietf.org/html/rfc6698 .
>>
>> Besides other things correctly configured TLSA record + client side
>> validation prevents rogue or compromised CAs from issuing "fake but
>> accepted as valid" certs.
>>
>> So I would say RIPE NCC is attempting to do security it in the most
>> modern way available.
> Yep. I wish the use of TLSA was more wide spread. It doesn't require third parties to "certify" who is who.


The third parties that "certify" are for others to establish trust in 
that you are who you claim to be not because its "required" and the 
security industry has deemed those who do not atleast get some other 
entity to validate, not to be worthy of trust.


Just because Trump says he's a genius and the "chosen one" does not make 
him one now does it...


JBG