tptacek on Setting up a trusted, self-signed SSL/TLS certificate authority in Linux · Hackerly

Comment on Setting up a trusted, self-signed SSL/TLS certificate authority in Linux parent

CAA does not require DNSSEC or DOH.