Hacker News Reader

And who is going to issue you a reasonably-priced intermediate cert? Especially since PKIX name constraints don't actually work, so that intermediate cert would let you sign just about anything.

View on HN

For your own web servers and your own clients, use your own CA and your own certs.

This isn't a serious solution except for intranets--and this problem exists most pressingly on the internet to begin with.

Reply on news.ycombinator.com