Per-Entity Metadata Working Group

["Cantor, Scott" <>]

> My naive understanding was that many of the commercial CDN
> providers allow one to specify the X.509 certificate chain to
> be used for TLS.
> 
> Am I wrong or missing the point or ?

I think I read something leading me to believe that wasn't true. I guess I 
wasn't thinking...if you have to make the one single name resolve to many 
different CDNs, I guess that implies control of the key.

But it doesn't entirely invalidate the point. The preferred model is a 
self-signed certificate. But if you don't share the key across all the CDNs, 
you'd end up with multiple trust anchors either way, and the consumer would 
have to trust all of them. Manageable but annoying.

You can easily see why the CDNs get away with that. People don't really care 
who the certs are from on web sites and the real goal is to get certs that 
will be trusted automatically with no explicit choice to do so. Automatic 
trust is an oxymoron IMHO.

-- Scott