3 ms·
I think the argument here is given for servers that can only be accessed via an internal network; ie those eavedroppers would have to be on the internal network
by alexchamberlain 8y ago
I think the argument here is given for servers that can only be accessed via an internal network; ie those eavedroppers would have to be on the internal network.
- michaelt 8y agoWhat lostapathy means is, because X.509 Name Constraints don't work [1], there's no way for Example Inc's administrators to limit their corporate CA to only issue certs for subdomains of example.com So if Example Inc puts their cert on every employee's machine, then a hacker or rogue insider could issue a cert for paypal.com and MITM every employee. Starting an internal CA introduces the risk of this bad thing happening. [1] https://security.stackexchange.com/a/31382 https://security.stackexchange.com/a/31382