TLSA record hygiene for Let's Encrypt issuer CAs
Viktor Dukhovni via Exim-users <[email protected]>
| Newsgroups | gmane.mail.exim.user |
|---|---|
| Message-ID | <[email protected]> |
Please see:
https://list.sys4.de/hyperkitty/list/[email protected]/thread/FUUH4KTUI5PMDD44X6JV5KLIPVRCH27P/
TL;DR:
- DO publish ALL applicable intermediate CAs when any are published
- DON'T publish TLSA records matching long-retired LE CAs.
--
Viktor.
--
## subscription configuration (requires account):
## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## [email protected]
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/