[atlas] SSL Certificates for ripe anchors

Randy Bush <randy at psg.com> writes:

>> Which is the reason why no major browser does TLSA validation.
>
> well. there is the extra protocol turn.  agl tried and backed off,
> seemingly because of that.

I hear that.  And I see them pushing DNS over HTTPS at the same
time. Doesn't really compute...

They are so good at making up excuses.  A couple of yours ago they
didn't need TLSA validation beacuse HPKP was so much better:
https://www.imperialviolet.org/2015/01/17/notdane.html

Where did that go? Oh, yes, turns out it wasn't such a good idea anyway:
https://ordina-jworks.github.io/security/2018/02/12/HPKP-deprecated-what-now.html

So now we're back to ultimate trust in the CAs again, using CT and CAA.
Nice move.

> but, if we want to encourage tlsa, recommended values for the three
> lovely but obscure (after all, it is the dns) parameters.  victor
> whacked me into using 211 with let's encrypt certs.

I prefer 3 1 1 for my certs, pinning my own key regardless of who else
signed it. 


Bjørn