4 ms·

Is this against some sort of rule? They're allowing their clients to run their own delegate CAs, this can be very convenient for sysadmins. I'm not sure what's

by ak217 14y ago

Is this against some sort of rule? They're allowing their clients to run their own delegate CAs, this can be very convenient for sysadmins. I'm not sure what's bad about it, or what new attacks it enables.

0x0 14y ago
Unless I'm completely mistaken, running a delegate CA means you can MITM any SSL site on the internet.
- ak217 14y ago
  Oh. That makes sense, thanks. Is there no way to restrict a CA cert to only be able to sign certs under a particular domain name/CN?
  - 0x0 14y ago
    Not that I know of (and tptacek seems to confirm the same elsewhere in this thread)
    - tptacek 14y ago
      He confirmed it wrongly.
  - ef4 14y ago
    There's not, and that's one of the major flaws with the design of the SSL certificate ecosystem.
    - tptacek 14y ago
      No, there is a way to do this, and it appears to be mostly effective today.
      - ef4 14y ago
        Link please?
        tptacek 14y ago
        No, sorry.
        arjie 14y ago
        Name Constraints extension.
  - lawnchair_larry 14y ago
    There is a way, and they stated that they are not properly doing it.