3 ms·
I have my own certs signed by my own CA that I trust enough to have in my browser allowed CA cache However I'd far rather be able to import a root cert with my
by iso1631 6y ago
I have my own certs signed by my own CA that I trust enough to have in my browser allowed CA cache
However I'd far rather be able to import a root cert with my own constraints -- use this root cert to authenticate by only for sites in my list (which I'd add say .blarge.com, .muhhaa.de, dohicky.google.com, etc), but that feature doesn't site in firefox, I either trust the root or I don't, which means I have to be far more careful about the root cert because rather than intercepting a few dev sites.
- tialaramex 6y agoIf you want this, (I don't advise it but you seem to have your heart set) the way to do it goes like this: 1. Generate a fresh root as you do today. Keep the resulting CA certificate for the root to one side, let's call this CA1 2. Create an intermediate CA certificate, this says there's a new CA, let's call it CA2 with a new private key, and this certificate gets to have constraints. Put all the constraints you've decided upon in here. Sign it using CA1 with your private key. 3. Destroy the private key for CA1. 4. Tell Firefox to trust root CA1. 5. You can now issue from CA2 and since it chains back to CA1 this is trustworthy, but only so long as it obeys the constraints. You can't issue from CA1 (which is fully trusted) because you destroyed the key.
- tedunangst 6y agoFirefox supports the name constraints extension.
- iso1631 6y agoProblem with the constraints is that relies on me creating new intermediate certificates for every new domain