News for hackers. Stuff that matters.

A comment on Running one’s own root Certificate Authority in 2023. Parent comment

Re:Running one’s own root Certificate Authority in 2023 by vbezhenar on Sunday September 17, 2023 @07:28AM (#37543880)
I don't understand the difference between wildcard certificate and intermediate certificate.

Intermediate certificate is more secure because you can use different certificates for different subdomains, insead of sharing private key for wildcard certificate with every subdomain server.

Whether it hits CT or not - is not relevant at all. What matters is if intermediate certificate hits CT.

[ Parent | on HN ]
Re:Running one’s own root Certificate Authority in 2023 by nickf on Sunday September 17, 2023 @07:43AM (#37543981)
A wildcard covers one single level of sub-domains. An NC'd CA can be used to issue for anything. Nameconstraints are 'enforced' on the client side and many don't support it. Running a public CA - even with a nameconstrained CA, is a challenge to do properly.
[ Parent | on HN ]
Re:Running one’s own root Certificate Authority in 2023 by vbezhenar on Sunday September 17, 2023 @07:57AM (#37544096)
One of the parents claims that everything supports name constraints now, so my suggestion was with this assumption in mind.
[ Parent | on HN ]