4 ms·
Intermediates aren't a delegation mechanism as such. They're a way to navigate to the roots trust. The trust is always in the root itself. It's not an active
by everfrustrated 1y ago
Intermediates aren't a delegation mechanism as such. They're a way to navigate to the roots trust.
The trust is always in the root itself.
It's not an active directory / LDAP / tree type mechanism where you can say I trust things at this node level and below.
- stego-tech 1y agoAppreciate the clarification! My grievance still stands, but at least I can articulate it better going forward.
- account42 1y agoBut they could and IMO should be a delegation mechanism. The Name Constraints extension already exists.
- everfrustrated 1y agoThe trouble is the constraint mechanism is outside of the inherent chain of trust logic and is checked using application level logic. So you have to modify all potential clients for this constraint to be enforced. So it's effectively worthless as there is no way to roll it out in any meaningful sense.