DANE rollover improvements - Githubissues

internetstandards / Internet.nl

Internet standards compliance test suite

https://internet.nl

171 stars 35 forks source link

DANE rollover improvements #1283

Open bwbroersma opened 6 months ago

bwbroersma commented 6 months ago

DANE rollover detection:

Currently a DANE-EE (3) + DANE-TA (2) on the same cert is considered a rollover, but it is not, probably it should even be a :warning:.
A DANE-TA (2) on a non-parent of the DANE-EE (3) is considered a rollover, I've seen Let's Encrypt certificates in the DANE-EE while the DANE-TA is set on Sectigo.

Also see https://github.com/internetstandards/Internet.nl/issues/1206#issuecomment-1901245290 with e.g. duplicating a DANE-EE or DANE-TA entry with the same information.