TLS Mastery - Hackdot

Re:TLS Mastery by superkuh on Sunday April 11, 2021 @10:57AM (#26770745)

Step 1. Give up volition to a third party certificate authority and hope your internet service is never controversial enough to get it revoked like sci-hub.

[ Parent | on HN ]

Re:TLS Mastery by iso1631 on Sunday April 11, 2021 @01:27PM (#26771936)

I have my own certs signed by my own CA that I trust enough to have in my browser allowed CA cache

However I'd far rather be able to import a root cert with my own constraints -- use this root cert to authenticate by only for sites in my list (which I'd add say .blarge.com, .muhhaa.de, dohicky.google.com, etc), but that feature doesn't site in firefox, I either trust the root or I don't, which means I have to be far more careful about the root cert because rather than intercepting a few dev sites.

[ Parent | on HN ]

Re:TLS Mastery by tialaramex on Sunday April 11, 2021 @03:23PM (#26772729)

If you want this, (I don't advise it but you seem to have your heart set) the way to do it goes like this:

1. Generate a fresh root as you do today. Keep the resulting CA certificate for the root to one side, let's call this CA1

2. Create an intermediate CA certificate, this says there's a new CA, let's call it CA2 with a new private key, and this certificate gets to have constraints. Put all the constraints you've decided upon in here. Sign it using CA1 with your private key.

3. Destroy the private key for CA1.

4. Tell Firefox to trust root CA1.

5. You can now issue from CA2 and since it chains back to CA1 this is trustworthy, but only so long as it obeys the constraints. You can't issue from CA1 (which is fully trusted) because you destroyed the key.

[ Parent | on HN ]

Re:TLS Mastery by tedunangst on Sunday April 11, 2021 @03:50PM (#26772881)

Firefox supports the name constraints extension.

[ Parent | on HN ]

Re:TLS Mastery by iso1631 on Monday April 12, 2021 @07:18AM (#26778128)

Problem with the constraints is that relies on me creating new intermediate certificates for every new domain

[ Parent | on HN ]

Re:TLS Mastery by creatonez on Monday April 12, 2021 @06:59AM (#26778021)

Interesting practical example... is sci-hub currently unable to get a certificate from Let's Encrypt?

[ Parent | on HN ]