Comment by vbezhenar
11 years ago
We have DNS system in place which should be enough to establish trust between browser and SSL public key. E.g. site could store self-signed certificate fingerprint in the DNS record and browser should be fine with that. If DNS system is spoofed, user will be in bad place anyway so DNS system must be secured in any case.
No. A proper certificate protects against malicious DNS resolver.
What you're talking about is being introduced alongside DNSSEC, and it's called DANE.
https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...