11 ms·
A wildcard covers one single level of sub-domains. An NC'd CA can be used to issue for anything. Nameconstraints are 'enforced' on the client side and many don'
by nickf 3y ago
A wildcard covers one single level of sub-domains. An NC'd CA can be used to issue for anything. Nameconstraints are 'enforced' on the client side and many don't support it.
Running a public CA - even with a nameconstrained CA, is a challenge to do properly.
- vbezhenar 3y agoOne of the parents claims that everything supports name constraints now, so my suggestion was with this assumption in mind.