4 ms·
Name constraints apply all the way down the chain - intermediates are implicitly limited by the constraints on their root. CAs have been name constrained in th
by agl 12y ago
Name constraints apply all the way down the chain - intermediates are implicitly limited by the constraints on their root.
CAs have been name constrained in the past, see the update here about ANSSI: http://googleonlinesecurity.blogspot.com/2013/12/further-improving-digital-certificate.html http://googleonlinesecurity.blogspot.com/2013/12/further-imp...
- deleted 12y ago[deleted]
- agl 12y agoA Chrome update was needed because the constraint was applied retrospectively. A name constraint is usually an X.509 extension that is included in the certificate.
- deleted 12y ago[deleted]
- agl 12y ago> Every time you visit a page the OS/browser doesn't go up the entire chain of trust and check for constraints. Oh, certainly they do. Name constraints work just like that: https://tools.ietf.org/html/rfc5280#section-4.2.1.10 https://tools.ietf.org/html/rfc5280#section-4.2.1.10 So does Extended Key Usage in practice, although it's not defined that way. There are some platforms where name constraints aren't implemented, but CAPI (Windows) certainly does implement it and I believe that NSS does also.