3 ms·
It does; they're called "name constraints". This page https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html https://systemoverlord
by jesboat 5y ago
It does; they're called "name constraints".
This page
https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html https://systemoverlord.com/2020/06/14/private-ca-with-x-509-... claims they're supported by "all current browsers".
x509 extensions can be marked "critical" or not. If the name constraint was marked critical, then AIUI old software should (in theory) fail secure, and reject everything signed by the CA.