5 ms·

Oh. That makes sense, thanks. Is there no way to restrict a CA cert to only be able to sign certs under a particular domain name/CN?

• 0x0 14y ago
  Not that I know of (and tptacek seems to confirm the same elsewhere in this thread)
  • tptacek 14y ago
    He confirmed it wrongly.
• ef4 14y ago
  There's not, and that's one of the major flaws with the design of the SSL certificate ecosystem.
  • tptacek 14y ago
    No, there is a way to do this, and it appears to be mostly effective today.
    • ef4 14y ago
      Link please?
      • tptacek 14y ago
        No, sorry.
      • arjie 14y ago
        Name Constraints extension.
• lawnchair_larry 14y ago
  There is a way, and they stated that they are not properly doing it.