View source for X.509+DNSSEC+DANE+CAA

== X.509 for SSL and TLS ==

The "certificates" that identify a website for "https" secure browsing.

Other tools exist to strengthen security and domain ownership beyond "commercial certs" offered by common vendors.

== Domain Name System Security Extensions ==

https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions

== DNS-based Authentication of Named Entities ==
A system called [https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities DANE] was proposed in [https://tools.ietf.org/html/rfc6698 RFC 6698] "as a way to authenticate TLS client and server entities without a certificate authority (CA)," but it has never been very widely deployed.

The use of a CA or "commercial" certificate does not exclude the use of DANE, of course. If you enable DNSSEC on your domain, there is no reason why you cannot authorize your current "commercial" X.509 certificate via DANE, as well, independently of any commercial certification.

== Certification Authority Authorization ==

Somewhat as an alternative or adjunct to DANE, a much simpler system known as [https://www.farsightsecurity.com/txt-record/2017/08/25/stsauver-caa-records-farsight/ CAA] was developed, with the advantage that [https://www.rfc-editor.org/rfc/rfc8659.html CAA] does not ''require'' DNSSEC as an absolute dependency for deployment.

https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization