2 ms·
It would be good to be able to only trust CAs with some TLDs. That would limit the harm for adding a geographically useful CA to only a certain segment of the i
by philipwhiuk 4y ago
It would be good to be able to only trust CAs with some TLDs. That would limit the harm for adding a geographically useful CA to only a certain segment of the internet.
- notanote 4y agoThe ability exists. Such constraints aren't used very often for root certificates though, as far as I can tell. The Japanese Government CA which was mentioned in the discussions around TrustCor was constrained to .go.jp.
- angry_octet 4y agoIt needs to be supported in the clients, both browsers and libraries. I'm actually mad that scope restrictions are not more commonly used, and that tooling is absurdly complicated. It would be useful for internal CAs too, because they could be trusted for only a specific subdomain, eg *.intranet.acme.com.
- thatcks 4y agoOne of the problems with domain restrictions on CAs is that real world geography has turned out to not correlate with domain name 'geography' for general use. Organizations located in a country (or the EU or etc) will register their domains all over, instead of nicely restricting themselves to something under a single TLD or a small number of them, where they could use a restricted-scope CA. This mostly leaves you with organizational CAs, such as government ones (for the government's sites), and they seem to not have been too popular in practice.
- SahAssar 4y agoSeems like it would mirror how the registrar system works, where some registrars are able to register most TLDs and some are more regional. I'm guessing that for some TLDs it would make even more sense like for .gov or .google or similar.