3 ms·
> after the "ban" they also introduces some leniency in getting an intermediate singing cert for internal domains because in many cases the reason why a company
by throwaway7767 11y ago
> after the "ban" they also introduces some leniency in getting an intermediate singing cert for internal domains because in many cases the reason why a company would buy a "CA" cert for an internal domain / host was regulatory and auditors don't care what the cabforum has to say.
Wait, so you're saying that CAs are giving out intermediate roots to customers on the promise that they won't give out the private key? If this is the case, please provide examples of CAs that do this, so I can open bugs in the relevant software to request the root CAs be removed.
TrustWave did this, and got a lot of flack for it. In the end they stated it was a mistake and they'd never do it again, so they got to keep their cert (a mistake in my opinion, as they already demonstrated that they can't be trusted with CA powers).
Or did you mean they provide regular server certs or wildcards for internal domains?
- mschuster91 11y agoIsn't it possible for a CA cert to have authority only for *.foo.com?
- throwaway7767 11y ago> Isn't it possible for a CA cert to have authority only for *.foo.com? Technically, you can do that with name constraints. In practice, you can't because many SSL implementations (like, say, OpenSSL[0]) won't honour it, so it'd effectively be an unrestricted root CA for those. [0] http://blog.codekills.net/2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/ http://blog.codekills.net/2012/04/08/adventures-in-x509-the-...