3 ms·
Does our CA/browser infrastructure prevent the government from registering a trusted .gov CA instead of a trusted root CA?
by Abekkus 3y ago
Does our CA/browser infrastructure prevent the government from registering a trusted .gov CA instead of a trusted root CA?
- ComputerGuru 3y agoIt currently does, unless they get a cert cross-signed from a CA that’s in the root CA list. Which is a problem with the root cA design.
- toast0 3y agoNameConstraints seem to be well supported now, although the farther away from browsers you go, the harder it is to know for sure. That said, I'm not aware of any active use. Some root programs constrain some of the roots within, but afaik, not by having an x.509 cert with name constraints.