3 ms·
3. use cross signing with name constraints to not have this problem https://tools.ietf.org/html/rfc5280#section-4.2.1.10 https://tools.ietf.org/html/rfc5280#se
by merb 6y ago
3. use cross signing with name constraints to not have this problem
https://tools.ietf.org/html/rfc5280#section-4.2.1.10 https://tools.ietf.org/html/rfc5280#section-4.2.1.10
- fomine3 6y agoIssuing CA cert with Name Constraints is good, but end user should recognize the certificate is constrained to their domains or not.
- midasuni 6y agoThe end user should be able to choose the domains the root is valid for - regardless of x509 name constraints.
- Sebb767 6y ago4. Find out that name constraints are either not supported or ignore by basically all major libraries.