Re:.INTERNAL is now reserved for private-use applications
by layer8 on Sunday August 11, 2024 @07:58AM
(#41215579)
It's required by RFC 5280 (and predecessor), so it’s fairly well supported.
[ Parent
| on HN ]
Re:.INTERNAL is now reserved for private-use applications
by 8organicbits on Sunday August 11, 2024 @10:39AM
(#41216496)
Do you have any references for that? There are lots of RFCs that are weakly adopted or even ignored. When I tested Chrome they didn't support name constraints, but have since added support. I suspect other software is still lagging.
Re:.INTERNAL is now reserved for private-use applications
by thayne on Sunday August 11, 2024 @05:34PM
(#41219473)
From the issue for support on chrome, it sounds like RFC 5280 requires it for intermediate CAs, but is ambiguous on whether it is required for root CAs (which in this case, is where you want it). So chrome didn't support it on root CAs until recently, at least on Linux.
Although, ideally, it would be possible to limit the scope of a CA when adding it to the trust store, and not have to rely on the creator of the CA setting the right parameters.