News for hackers. Stuff that matters.

A comment on Forthcoming OpenSSL releases. Parent comment

Re:Forthcoming OpenSSL releases by erglkjahlkh on Monday July 06, 2015 @12:44PM (#9840372)
3) Does anyone have any reference to this?
[ Parent | on HN ]
Re:Forthcoming OpenSSL releases by antsar on Monday July 06, 2015 @12:53PM (#9840435)
Here's [0] the relevant section of the X.509 RFC (Name Constraints). Unfortunately, last time this was discussed on HN, someone mentioned that Name Constraints are not supported by all client software, making it unsafe to rely on them.

[0] http://tools.ietf.org/html/rfc5280#section-4.2.1.10

[ Parent | on HN ]
Re:Forthcoming OpenSSL releases by zokier on Monday July 06, 2015 @12:57PM (#9840469)
I'd imagine (based on very superficial knowledge) that DANE would achieve something to that effect. But it's pretty much dead because apparently DNSSEC wasn't all that great.
[ Parent | on HN ]