Noob question alert.
I understand SSL certificates help mitigate MITM attacks, but I see the process to be so badly designed.
Basically the client needs to verify that it is talking to the particular domain's ip. This could be implemented this way. There could be a DNS record containing the server's public key. The client could then proceed with the verification and ssl process with the public key.
This will eliminate the following :
No certificate
No certificate authority
Browsers dont need to trust CAs
I dont have to pay and wait for my certificate.
Am I missing anything?