4 ms·
No, you're right Ptacek because in this case the extension is being marked NON-critical. I.e., if the client code doesn't recognize the name constraint extensio
by marshray 14y ago
No, you're right Ptacek because in this case the extension is being marked NON-critical. I.e., if the client code doesn't recognize the name constraint extension, it's OK to just ignore it.
- tptacek 14y agoIf that is a problem that impacts only one popular browser, I find it easier to cast blame at the feet of the browser.
- marshray 14y agoYou're forgetting the huge mass of non-browser SSL/TLS clients. Do you see the expressions of surprise about this policy here on HN? These are the world's more informed client application developers. Consider now that your home router's firmware update client, your server's IPMI, and the entire global network for real-time trading of [strategic material] was written by developers to RFCs that told them they had absolutely no reason to implement the Name Constraints extension because if it ever appeared, it was guaranteed to be marked 'critical'.