> Isn't it possible for a CA cert to have authority only for *.foo.com? Technically, you can do that with name constraints. In practice, you can't because many

> Isn't it possible for a CA cert to have authority only for *.foo.com? Technically, you can do that with name constraints. In practice, you can't because many SSL implementations (like, say, OpenSSL[0]) won't honour it, so it'd effectively be an unrestricted root CA for those. [0] http://blog.codekills.net/2012/04/08/adventures-in-x509-the-utterly-ignored-nameconstraints/ http://blog.codekills.net/2012/04/08/adventures-in-x509-the-...