Tailscale Has Partnered with Mullvad

Re:Tailscale Has Partnered with Mullvad by lxgr on Friday September 08, 2023 @12:03AM (#37429144)

That's a neat idea! I looked into name constraints many years ago, and at the time, no common browser or TLS library supported it; glad to see that that has changed.

With ubiquitous support, I hope that one day we'll be able to routinely get "subdomain CA certificates" issued by something like Letsencrypt, just like it's already possible to get wildcard certificates.

[ Parent | on HN ]

Re:Tailscale Has Partnered with Mullvad by eptcyka on Friday September 08, 2023 @01:21PM (#37436512)

Since when have TLS certs not been pinned to specific domains?

[ Parent | on HN ]

Re:Tailscale Has Partnered with Mullvad by codetrotter on Saturday September 09, 2023 @12:33AM (#37442315)

Parent commenter is talking about having a sub CA that is restricted to issuing certs for a specific domain.

For example let’s say that I am hosting a website at somewhere.example.com

Today I would be able to get a Let’s Encrypt TLS cert for somewhere.example.com and if I control the DNS for somewhere.example.com I can get a wild card cert for *.somewhere.example.com

But from what parent is saying, with name constraints it would be possible for Let’s Encrypt to give me a cert that would allow me to act as CA for anything under my somewhere.example.com

Meaning that I could for example issue a TLS cert for treehouse.internal.somewhere.example.com using the restricted CA certificate that was given to me.

I think.

[ Parent | on HN ]

Re:Tailscale Has Partnered with Mullvad by eptcyka on Sunday September 10, 2023 @04:27PM (#37459703)

Thank you so much for the elaboration, I really appreciate it.

[ Parent | on HN ]