3 ms·

Can one create a CA with a limitation to `.example.com`? Or can one install an arbitrary CA and limit it to `.example.com`?

by n3t 4y ago

Can one create a CA with a limitation to `*.example.com`? Or can one install an arbitrary CA and limit it to `*.example.com`?

zamadatix 4y ago
Name Constraints allow for this.
- Macha 4y ago
  Just be aware that support in non-browser software is not so widespread and for something which doesn't understand the extension, it's still effectively a global CA if installed
  - jeffparsons 4y ago
    Be that as it may, this still doesn't seem like the big deal that so many people are making it out to be. Support for HTTP/1.1 and HTTP/2 won't be going anywhere fast, so legacy software can keep doing what it's always done, can't it? HTTP/3 can be for people/applications that value what is has to offer, and can largely be ignored otherwise.
    - superkuh 4y ago
      HTTP/1.1 is the last good HTTP that is designed for a human persons' needs instead of corporate persons needs. It'll be phased out of the megacorp browsers as soon as their services no longer require it. Likely they'll say it's for security reasons. And they won't be wrong (about their use case). They'll just be ignoring humans because human projects don't earn them money.
    - Macha 4y ago
      Note: My post was talking about Name Constraints in TLS certs and not HTTP versions. The edit window is expired so I can no longer clarify there.
tialaramex 4y ago
If you don't care about older software, in particular older Macs, yes, you can proceed as follows: 1. Make CA #1 2. Make CA #2, have CA #1 sign (a certificate for) this CA with a constraint saying it is valid only for DNS names in example.com and nothing else 3. Destroy CA #1 irrevocably 4. Trust CA #1 in your browser or other relying party software 5. You can now use CA #2 to issue with your constraint. If you care only about specific web browsers, you can modify the browser software (this is practical for Firefox and to some extent Chromium) to alter its built-in trust semantics to give you chosen CA different constraints. Firefox ships with constraints for a handful of CAs which, in Mozilla's opinion, can be afforded such limited trust so you can model your changes on how that works. https://wiki.mozilla.org/CA/Additional_Trust_Changes https://wiki.mozilla.org/CA/Additional_Trust_Changes
midasuni 4y ago
Name constraints allow it, if be happier if I could import a certificate and set my own constraints in the certificate manager - “I trust this for all *.bigcorp.com domains but not for mybank.com”

Can one create a CA with a limitation to `*.example.com`? Or can one install an arbitrary CA and limit it to `*.example.com`?

by n3t 4y ago

Can one create a CA with a limitation to `*.example.com`? Or can one install an arbitrary CA and limit it to `*.example.com`?

zamadatix 4y ago

Name Constraints allow for this.

Macha 4y ago
Just be aware that support in non-browser software is not so widespread and for something which doesn't understand the extension, it's still effectively a global CA if installed
- jeffparsons 4y ago
  Be that as it may, this still doesn't seem like the big deal that so many people are making it out to be. Support for HTTP/1.1 and HTTP/2 won't be going anywhere fast, so legacy software can keep doing what it's always done, can't it? HTTP/3 can be for people/applications that value what is has to offer, and can largely be ignored otherwise.
  - superkuh 4y ago
    HTTP/1.1 is the last good HTTP that is designed for a human persons' needs instead of corporate persons needs. It'll be phased out of the megacorp browsers as soon as their services no longer require it. Likely they'll say it's for security reasons. And they won't be wrong (about their use case). They'll just be ignoring humans because human projects don't earn them money.
  - Macha 4y ago
    Note: My post was talking about Name Constraints in TLS certs and not HTTP versions. The edit window is expired so I can no longer clarify there.

tialaramex 4y ago

If you don't care about older software, in particular older Macs, yes, you can proceed as follows: 1. Make CA #1 2. Make CA #2, have CA #1 sign (a certificate for) this CA with a constraint saying it is valid only for DNS names in example.com and nothing else 3. Destroy CA #1 irrevocably 4. Trust CA #1 in your browser or other relying party software 5. You can now use CA #2 to issue with your constraint. If you care only about specific web browsers, you can modify the browser software (this is practical for Firefox and to some extent Chromium) to alter its built-in trust semantics to give you chosen CA different constraints. Firefox ships with constraints for a handful of CAs which, in Mozilla's opinion, can be afforded such limited trust so you can model your changes on how that works. https://wiki.mozilla.org/CA/Additional_Trust_Changes https://wiki.mozilla.org/CA/Additional_Trust_Changes

midasuni 4y ago

Name constraints allow it, if be happier if I could import a certificate and set my own constraints in the certificate manager - “I trust this for all *.bigcorp.com domains but not for mybank.com”