5 ms·

You can use the X.509 Name Constraints extension to limit the power of your CA to just a single TLD. I personally just run on a public TLD with a wildcard cert

You can use the X.509 Name Constraints extension to limit the power of your CA to just a single TLD. I personally just run on a public TLD with a wildcard cert (so my domains don't show up in cert transparency), but there is an alternative. - https://www.sysadmins.lv/blog-en/x509-name-constraints-certificate-extension-all-you-should-know.aspx https://www.sysadmins.lv/blog-en/x509-name-constraints-certi... - https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10 https://www.rfc-editor.org/rfc/rfc5280#section-4.2.1.10 Apparently (I haven't tested this), Chrome only checks this on intermediate certs not root certs but you can mitigate around that by keeping your root cert offline. Will only work on "modern" browsers and operating systems. https://bugs.chromium.org/p/chromium/issues/detail?id=1072083 https://bugs.chromium.org/p/chromium/issues/detail?id=107208...

bo0tzz 4y ago
> you can mitigate around that by keeping your root cert offline. This is something you should probably do anyways.
xoa 4y ago
I use that extensively on a bunch of private CAs, know though that it can sometimes be a touch quirky. For example, certain applications/libraries will apparently look for anything that "looks like it has a domain in it" in the cert and check it against the constraint, so for example if you have a root CA with a constraint to only abc.com but then have the admin contact email set as admin@xyz.com it'll complain even though browsers are fine. This is clearly a bug but it's been floating around for a long time (though I haven't checked in a while granted). And I always do [root ca] > [intermediate online ca] > [more specific constrained cas if required] with root kept fully offline and the intermediate one used for online signing convenience. Overall I think doing one's own CA is unnecessarily irritating to get into, plenty of very strange behavior in openssl and how everything interacts, irritating to learn and keep up with best practices, and of course it's a lot harder to get things trusted for a domain that you own then it should be. I wish the whole ecosystem there was a lot better because it's one of the key bits of gatekeeping/centralization/privacy. Let's Encrypt helps but is specifically for public websites, not other usage. Even so it's still very useful to have that power and flexibility for nothing, and there are capabilities in extensions to help enforce better practices.
ithkuil 4y ago
And MacOS supports them finally since High Sierra

bo0tzz 4y ago

> you can mitigate around that by keeping your root cert offline. This is something you should probably do anyways.

xoa 4y ago

I use that extensively on a bunch of private CAs, know though that it can sometimes be a touch quirky. For example, certain applications/libraries will apparently look for anything that "looks like it has a domain in it" in the cert and check it against the constraint, so for example if you have a root CA with a constraint to only abc.com but then have the admin contact email set as admin@xyz.com it'll complain even though browsers are fine. This is clearly a bug but it's been floating around for a long time (though I haven't checked in a while granted). And I always do [root ca] > [intermediate online ca] > [more specific constrained cas if required] with root kept fully offline and the intermediate one used for online signing convenience. Overall I think doing one's own CA is unnecessarily irritating to get into, plenty of very strange behavior in openssl and how everything interacts, irritating to learn and keep up with best practices, and of course it's a lot harder to get things trusted for a domain that you own then it should be. I wish the whole ecosystem there was a lot better because it's one of the key bits of gatekeeping/centralization/privacy. Let's Encrypt helps but is specifically for public websites, not other usage. Even so it's still very useful to have that power and flexibility for nothing, and there are capabilities in extensions to help enforce better practices.

ithkuil 4y ago

And MacOS supports them finally since High Sierra