Hacker News Reader

Comment by midasuni | Hacker News Reader

And now any security mishap with your CA compromises your entire browser because you can’t just trust a custom root certificate for “*.my stuff.com” without trusting for mybank.com

View on HN

Firefox appears to support[0] name constraints[1] in CA certificates. It even appears to have code that supports adding further constraints to the root certificates after they were imported, but that doesn't seem to be exposed anywhere in the UI.

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=856060 [1] https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1....

That’s a small phish to spear! And if the CA very is kept on local host, compromising it means you’ve already compromised my system.

If you're that much of a target, you'll find your devices hacked soon enough regardless.

I can't speak about your threat model, but "exfiltrating my private CA keys to phish my browser" isn't really something I worry about in practice.

For those still checking certificate validity, Firefox will warn you that the certificate used is not in the system database when you click the little lock in the address bar.

That said, I'd absolutely love a system where I could restrict my private CA to certain domains.

You can use name constraints on the CA, but they are a bit hit and miss when it comes to client support.

For a local CA with the CA only on one machine you're perhaps OK if you are careful, but once you share the server with a couple of collegues you are potentially into a world of hurt.

On OSX you can choose "Always Trust" or "Never Trust" for various purposes (code signing, SSL, EAP, etc).

Why can't I have "Ask first time", or "Trust only for specific domains"

Same with built in ones. That "Hong Kong Post" root CA raises some eyebrows with me, I'd love to set that to "Ask first time" on it.

I think you can mitigate this by deleting your CA key after signing a certificate for localhost. Sure, that means you can't sign new certificates, but that's not a big deal as you can just replace the CA on your desktop when the time comes.

I do not recommend using the same browser for everyday web browsing and for development. For one thing, you don't want an adblocker or other content altering plugins on your dev browser.

I like Firefox with Tree Style Tabs and an adblocker for everyday browsing, and some Chrome derivative with no addons other than Xdebug for development. Lately I've been using the Responsively browser for dev, especially if I need to do anything mobile.

Reply on news.ycombinator.com