News for hackers. Stuff that matters.

A comment on Chromium and Mozilla to enforce 1 year validity for TLS certificates. Parent comment

Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by lvh on Sunday June 28, 2020 @12:52PM (#23670112)
If only we had NameConstraints: we could have a CA limited to *.clientdevices.manufacturer.com, installed in everyone's trust root.
[ Parent | on HN ]
Re:Chromium and Mozilla to enforce 1 year validity for TLS c... by pas on Sunday June 28, 2020 @05:08PM (#23672068)
Installed? Everyone?

It would be enough to send it as an intermediate CA cert, no need to install.

Going the self-signed DNS name restricted CA way would likely still not fly with browsers, because there's no way to securely deploy the trust root. (Because if it requires user interaction to install that can be exploited by malicious actors.)

[ Parent | on HN ]