モジュールのレッスン (2/3)
CAA e DANE
CAA and DANE
Specifications: CAA, RFC 8659, DANE TLSA, RFC 6698, and DANE operational guidance, RFC 7671.
CAA records let a domain state which certificate authorities are allowed to issue certificates for it. They are a policy signal that certificate authorities check; they do not replace account security or certificate monitoring.
DANE uses TLSA records to associate a service with certificate or key information, with DNSSEC providing the authenticated DNS data on which the association depends. Without a valid DNSSEC chain, a client cannot rely on the TLSA record as authenticated. TXT, CAA, and TLSA have different formats and meanings; interpret each in the context of the protocol that uses it.
Check your understanding
Choose the best answer. This quiz runs locally and sends no DNS queries to real domains.
What does DANE authentication through TLSA depend on?