News for hackers. Stuff that matters.

A comment on Let's Encrypt Has Issued a Billion Certificates. Parent comment

Re:Let's Encrypt Has Issued a Billion Certificates by roblabla on Thursday February 27, 2020 @02:04PM (#22436593)
Actually, I believe there are. IIRC it's possible for a CA's root cert to be limited to only a certain TLD. There's an extension called "Name Constraints" that limits a Root SSL Cert, and I believe it is honored by chrome.

https://security.stackexchange.com/questions/31376/can-i-res...

[ Parent | on HN ]
Re:Let's Encrypt Has Issued a Billion Certificates by zaarn on Friday February 28, 2020 @07:41AM (#22442364)
It's an optional extension, so a client may ignore it without failing the connection. It needs a lot more adoption. I could, for example, instead of getting a wildcard cert, get LE to sign a CA valid for my domain. That way I can issue certs for my domain myself and put load off of LE.
[ Parent | on HN ]