Carbon Copy Countersignature Authorization with airSlate SignNow

Carbon copy countersignature authorization

[Music] hi my name is don bolman with agilicus where we make any application available to any user on any device simply and securely and today i thought i would share with you one of the tools we use to do that it's called dns caa certificate authority authorization it's a complex name it's very simple i promise this is something you could get done before you go home for the day and it will improve your security it'll cost you nothing and it's not going to have any risk too simple let's talk about it so what is the caa thing how does it relate to tls certificates and why do i want it well it's a standard rfc 8659 from the good folks at the ietf and in a nutshell you add a record to your dns and it indicates who you use for your certificates i use let's encrypt so i have a record that says for my domains it can only be issued by let's encrypt and if you use another certificate authority if another certificate authority is breached it's not going to issue for you so if somebody gets a hold of i don't know komodo and they try to issue a certificate and you have one of these records it won't issue so you're protected so it's simple to implement it adds some security it's no risk sign me up what do i do so first let's talk about why what was the motivation behind this standard so mistakes and breaches in certificate authorities happened you know for the last couple decades every once in a while human error cyber security breaches things happened and you don't want bad things happening to you if you can prevent it certificate transparency came out to sort of help with that problem and there's logs logs are generated every certificate is issued there's a record that comes out and you can at least go back and see it and that's a you know influence on the bad folks to not try to snoop around and issue something bad for your domain then http public key pinning it kind of happened i mean this turned out to be complicated to use and the browsers are withdrawing support for it but the key here is it was in the client and it was after the effect so if a ca authority a certificate authority was compromised and they issued a certificate for your domain in error if you'd done http public key pinning the browsers should have ignored it about that time another standard came out called dane this is also from the good folks at the ietf and again it's on the client side so this is to instruct the client that this certificate it's not for me i know it seems valid but you know don't trust it and what also happened about this time is we created the caa record and that was to prevent mis-issuance...