search

os3sec / Extended-DNSSEC-Validator

Firefox add-on for verification of x509 certificates using DNSSEC as bootstrap mechanism
http://os3sec.org
15 stars 9 forks source link

Adhere to tlsa spec #15

Closed gwitmond closed 11 years ago

gwitmond commented 11 years ago

Hi Danny,

Here are the patches I made to improve your validators adherence to the TLSA-spec.

It allows TLSA-usage values of 2 and 3. It complains loudly at values 0 and 1.

I included Paul Wouters patch to allow DLV-look-aside validation for those whose TLD is not yet included in the DNSSEC Root.

I took the liberty to bump the value to 0.8.

Cheers, Guido.