4 ms·
The RFC may or not matter, but what does matter is doing the right thing. For example, if critical Name Constraints are not universally supported, does that mak
by ivanr 14y ago
The RFC may or not matter, but what does matter is doing the right thing. For example, if critical Name Constraints are not universally supported, does that make it right to use the non-critical ones? I don't think so.
If Name Constraints are indeed important, I'd much rather see the CAB Forum first work with Apple until support is universal (or reasonably-well supported; whatever that means), and then start to use them.
- tptacek 14y agoCareful: two different arguments here. One is what Google is doing, the other is what GlobalTrust is doing. While I'm not alarmed by what GlobalTrust is doing, I think CA's should not be in the business of selling CA=YES certificates to other organizations. No matter what X.509 allows them to express.