3 ms·
Browsers seem to lack a way to trust a CA only for specific domains.
by keikobadthebad 4y ago
Browsers seem to lack a way to trust a CA only for specific domains.
- toast0 4y agoSome browsers apply restrictions to some CAs. There's support for it with X.509 nameConstraints; I don't know if support for that has increased though. Even if a browser doesn't support it in general, it can do similar things with its built in CA store.
- keikobadthebad 4y agox509 entries in the cert don't help if the cert is designed to sign false server certs... they obviously will not add the restriction to the CA. Browsers definitely are in a position to additionally restrict their trust to certs in their store to specific hostnames. But there doesn't seem to be any UI except explicit global trust and distrust.
- castillar76 4y agoWould love to see this as a ubiquitous feature—it would solve so many problems. Just for starters, it would fix the “here, install this root CA to join our mobile device management system/campus wireless network—oh oops, looks like that lets us spy on all your traffic anytime we choose” problem…