Server Certificates based on DNSSEC

Globally unique domain names and IP addresses that are provided in real time by the DNS (Domain Name System) represent the fundamental signposts for navigating the Internet and for locating remote hosts. It is therefore paradoxical that the traditional method for secure identification of remote hosts is not directly based on DNS, but on the browser PKI which is external to the trust structure of the DNS and thereby introduces new and complex trust problems. This paper argues that certificates for global host names must be issued through DNSSEC. According to this principle, certificates for domain names are issued by DNS registrars or DNS server organisations. This greatly simplifies the trust models for online authentication and significantly improve Internet security.