Server Certificates based on DNSSEC

Abstract. Globally unique domain names and IP addresses that are provided in real time by the DNS (Domain Name System) represent the fundamental sign-posts for navigating the Internet and for locating remote hosts. It is therefore paradoxical that the traditional method for secure identification of remote hosts is not directly based on DNS, but on the browser PKI which is external to the trust structure of the DNS and thereby introduces new and complex trust prob-lems. This paper argues that certificates for global host names must be issued through DNSSEC. According to this principle, certificates for domain names are issued by DNS registrars or DNS server organisations. This greatly simplifies the trust models for online authentication and significantly improve Internet security.