Timeline for Why a web server HTTPS certificate can't sign its subdomain HTTPS certificates?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 7, 2021 at 6:47 | history | edited | CommunityBot |
replaced http://tools.ietf.org/html/rfc with https://www.rfc-editor.org/rfc/rfc
|
|
| Sep 26, 2014 at 21:53 | comment | added | supercat |
If a CA in France is only authorized to issue certificates for .fr domains, one in Nigeria only for .ng domains, etc. then even if a CA was corrupt it would only affect the security of domains for which he could legitimately issue certificates. I would think it would be good for browsers to validate such things even if the feature weren't used for anything beyond that.
|
|
| Sep 26, 2014 at 21:49 | comment | added | supercat | From what I understand, certain countries' certificate authorities are only "authorized" to issue certificates for their countries' top level domain. I would think questions of whether a CA should be considered "trustworthy" enough to be considered a root CA would be greatly eased if certificate authorities could be accepted as root CAs only for addresses within the proper domain. | |
| Apr 3, 2013 at 19:58 | vote | accept | Vi. | ||
| Apr 3, 2013 at 19:57 | comment | added | Vi. | I was unhappy when I found out that setting up HTTPS server brings your from technology world to the cryel money-ridden world... We're on the way from IPv4 to IPv6 (where you typically get a large subnet instead of single addresses). Maybe it's time to also provide better SSL where you also get some large thing by default (i.e. can create a child certificate, like as "fork-chroot-drop_privileges" in Unix)..? | |
| Apr 3, 2013 at 19:45 | history | answered | Tom Leek | CC BY-SA 3.0 |