3 ms·

Unless I'm completely mistaken, running a delegate CA means you can MITM any SSL site on the internet.

• ak217 14y ago
  Oh. That makes sense, thanks. Is there no way to restrict a CA cert to only be able to sign certs under a particular domain name/CN?
  • 0x0 14y ago
    Not that I know of (and tptacek seems to confirm the same elsewhere in this thread)
    • tptacek 14y ago
      He confirmed it wrongly.
  • ef4 14y ago
    There's not, and that's one of the major flaws with the design of the SSL certificate ecosystem.
    • tptacek 14y ago
      No, there is a way to do this, and it appears to be mostly effective today.
      • ef4 14y ago
        Link please?
        • tptacek 14y ago
          No, sorry.
        • arjie 14y ago
          Name Constraints extension.
  • lawnchair_larry 14y ago
    There is a way, and they stated that they are not properly doing it.