3 ms·

> Is it possible to limit the CA to only cover certain domain Sure, via the Name Constraints extension. Supposedly client support is spotty, but I have no exp

• _flux 2y ago
  Thank you! I'll try that with my next CA, which I think is actually expired but it seems not all apps care about that :). If "relatively modern" covers browsers and email clients, that's pretty good already. edit: here's the reference: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10 https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.... and here's a practical example: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html https://systemoverlord.com/2020/06/14/private-ca-with-x-509-...