News for hackers. Stuff that matters.

A comment on MITM on HTTPS traffic in Kazakhstan. Parent comment

Re:MITM on HTTPS traffic in Kazakhstan by y0ghur7_xxx on Thursday July 18, 2019 @02:01PM (#20472368)
There is a Name Constraints extension in X.509[1] that does exactly that, but to my knowledge no browser implements it.

[1] https://tools.ietf.org/html/rfc5280#section-4.2.1.10

[ Parent | on HN ]
Re:MITM on HTTPS traffic in Kazakhstan by markovbot on Thursday July 18, 2019 @02:24PM (#20472603)
and that would have to be baked into the CA certificate, not specified when the CA is trusted. I dont want my browser to ask the CA what it's allowed to do, i want to tell it what it's allowed to do
[ Parent | on HN ]
Re:MITM on HTTPS traffic in Kazakhstan by y0ghur7_xxx on Saturday July 20, 2019 @04:10AM (#20484689)
It has to be baked into the CA, so that a browser vendor can check it before inclusion. If the CA specifies domains it is not allowed to sign certificates for, it will not be included.
[ Parent | on HN ]
Re:MITM on HTTPS traffic in Kazakhstan by jack12 on Thursday July 18, 2019 @05:08PM (#20473936)
> but to my knowledge no browser implements it

Firefox does, though I don't know how much they check beyond just the dNSName constraints. Here's the unit test making sure it stays working: https://github.com/mozilla/gecko-dev/blob/b8157dfaafc42deb3b...

[ Parent | on HN ]