News for hackers. Stuff that matters.

A comment on DNSSEC-Like Trust for Certificate Authorities. Parent comment

Re:DNSSEC-Like Trust for Certificate Authorities by foxcpp on Wednesday June 10, 2020 @05:50PM (#23482554)
>if you trust a third party CA they can just sign for anybody without limits

It is possible for a root certificate to have a name constraint making all certificates issued for other e.g. TLDs invalid. Like it is done in dn42 CA.

[ Parent | on HN ]
Re:DNSSEC-Like Trust for Certificate Authorities by detaro on Wednesday June 10, 2020 @06:16PM (#23482832)
Yes, that's the nicer solution, and it seems Apple finally got around to adding support for it as well a while back - for a long time they didn't support it, so name constraints broke validation for Safari and Chrome on macOS.
[ Parent | on HN ]