Hacker News Reader

Comment by rtpg | Hacker News Reader

I think it's possible for the CA to delegate the authority to a specific subset of domains. But in this case MCS holdings apparently was given a certificate allowing them control over everything.

View on HN

I'm not 100% sure, but fairly certain the way that x.509 works, there is a boolean field for whether or not the certificate is an authority, with no control over what they are an authority for. I believe this field is called basic constraints.

There is something called "name constraints" in X.509 that can be used to control which domain names, email addresses, etc. a sub-CA certificate can issue certificates for. See [1]. CAs are using them more and more frequently, especially after Mozilla added items #9 and #10 [2] to its inclusion policy a couple years ago.

[1] http://tools.ietf.org/html/rfc5280#section-4.2.1.10

[2] https://www.mozilla.org/en-US/about/governance/policies/secu...

Are there any CAs issuing these? How do I get a CA certificate with a name constraint for my domain?

Have you reasons to believe the existing x509 certificates handling code handles properly an extension that is seldom used, and will do it in all cases?

Validation of x509 certificates is ridiculously complex, and CA rightfully only use the widely interoperable subset of extensions...

I wonder about the downvotes, with the long documented history of software failing to properly validate certificate chains (or worse, trees).

See for example http://blog.codekills.net/2012/04/08/adventures-in-x509-the-... about what really happens when one steps outside the well traveled path of certificate attributes...

Some implementations--most unfortunately, Apple's--do not implement name constraints.

Speaking from personal experience, writing code to correctly validate x509 certificates isn't as hard as it looks.

Then you're likely in the top 10 experts of the field ;)

The fact that OpenSSL did it wrong for 15 years doesn't bode well for the myriads of TLS implementations that are around.

My experience with the x509 part of SSL/TLS stacks is really not good when you start to use something else than OpenSSL/NSS (well PolarSSL is pretty good too). Quite often there is enough implemented to interoperate in the common use cases, but you're on your own if you need a complete standard support... Then it has been a while, maybe it's a lot better now.

There are several (most famous is Verizon), but they tend to target larger companies.

Apparently name constraints don't constrain the CN field though, and that's what browsers validate domain names against.

In Mozilla's implementation, name constraints are applied to the CN field. I believe Chrome is the same way. Also, browsers "validate domain names" against the CN attribute and the dNSName entries in the subjectAltName extension.

Source: I wrote all that code in Mozilla's implementation.

Reply on news.ycombinator.com