Well the first problem with that scenario is it doesn't work for most of the internet. It requires CAs and domain owners to use DNSSEC, and most do not. It requires strict validation of DNSSEC, and most dns resolvers do not. It requires the use of CAA records, which most domain owners do not. And it requires CAs to properly implement CAA (it was found in 2017 that many did not, and Let's Encrypt messed up 3 million certs due to CAA in 2020). So, a single person with their own domain could do all these things, but the rest of the internet won't be doing it, so most of the internet will be insecure. That's not tenable, because that means the rest of the internet can be used in attacks that appear legitimate. Even most of the top 100,000 websites on the internet don't use DNSSEC and CAA, and if you asked them to, they'd ignore you.
But the second problem is it doesn't really solve the problem. Eventually you have to renew the cert, and when that happens, an attacker can spoof the IP of the validating source and have a valid cert issued. CA validation itself is flawed by design.
Comments
Well the first problem with that scenario is it doesn't work for most of the internet. It requires CAs and domain owners to use DNSSEC, and most do not. It requires strict validation of DNSSEC, and most dns resolvers do not. It requires the use of CAA records, which most domain owners do not. And it requires CAs to properly implement CAA (it was found in 2017 that many did not, and Let's Encrypt messed up 3 million certs due to CAA in 2020). So, a single person with their own domain could do all these things, but the rest of the internet won't be doing it, so most of the internet will be insecure. That's not tenable, because that means the rest of the internet can be used in attacks that appear legitimate. Even most of the top 100,000 websites on the internet don't use DNSSEC and CAA, and if you asked them to, they'd ignore you.
But the second problem is it doesn't really solve the problem. Eventually you have to renew the cert, and when that happens, an attacker can spoof the IP of the validating source and have a valid cert issued. CA validation itself is flawed by design.