Re:Let's Encrypt Overview
by JoshTriplett on Friday June 12, 2015 @04:12PM
(#9708240)
In particular, there are enough stacks that ignore it that it would be unsafe to issue a CA certificate even with nameConstraints.
[ Parent
| on HN ]
Re:Let's Encrypt Overview
by grahamedgecombe on Friday June 12, 2015 @05:31PM
(#9708686)
X509 extensions can be marked as critical. Certificates must be rejected if the stack encounters a critical extension it doesn't understand. (In theory at least, I haven't looked at real implementation behaviour.)