Running one’s own root Certificate Authority in 2023

Re:Running one’s own root Certificate Authority in 2023 by michaelt on Sunday September 17, 2023 @08:14AM (#37544233)

Name constraints are an optional feature in the standards. A client can ignore the constraints and be completely standards compliant.

Should the CAs issue intermediate certs that are only secure if a client implements an optional feature?

And even if most web browsers support name constraints properly - who knows if that cheap network webcam does, or that old mail client, or that 20 year old retro PC game?

[ Parent | on HN ]

Re:Running one’s own root Certificate Authority in 2023 by 3np on Sunday September 17, 2023 @09:03AM (#37544633)

So it may have limited use-cases today. For example internal controlled networks like discussed in the article.

Just like you presumably already wouldn't issue LE certs when you need to support clients with ancient CA bundles.

How do you think TLSv1.3 ever got rolled out?

[ Parent | on HN ]

Re:Running one’s own root Certificate Authority in 2023 by wejn on Sunday September 17, 2023 @09:44AM (#37544999)

This isn’t strictly true.

If you want to uphold the name constraints in your CA cert, mark the field as critical. At that point clients that don’t understand them should fail validation of the CA cert.

[ Parent | on HN ]