Timeline for Should name constraints be present on a subordinate CA issued to an organization?
Current License: CC BY-SA 3.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 19, 2015 at 17:46 | comment | added | Gabe | Some browsers (Safari) ignore name constraints. Other browsers will validate them if they are listed. If the name constraint is not marked as a "critical" section, the certificate continues to work in clients that ignore name constraints. | |
| Apr 7, 2015 at 14:33 | comment | added | Steffen Ullrich | According to code.google.com/p/chromium/issues/detail?id=407093 Apples Secure Transport does not support name constraints and thus Safari and Chrome on OS X don't. Firefox might support NC in current versions, at least bugs in this area where fixed a year ago: bugzilla.mozilla.org/show_bug.cgi?id=962760. But it is probably not a feature one can use as a critical constraint currently. And when used as non-critical it simply could be ignored. | |
| Apr 5, 2015 at 22:56 | comment | added | user29925 | Two things come to mind: user agents like browsers are just one class of software that consumes PKIX certificates. And I'm not sure Browsers ignore it since its codified at the CA/B Forums. (If it was only written in the IETF, then I would agree with you). | |
| Apr 5, 2015 at 8:18 | history | answered | Steffen Ullrich | CC BY-SA 3.0 |