4

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart.

I have a CA certificate with Name Constrains (RFC):

Permitted
     [1]Subtrees (0..0):
          DNS Name=valid.com
Excluded=None

Actually, I would like to prevent the CA from signing any other cert that can do a serverAuth, so I used a white list (would it be possible to have a Excluded = * ? how?)

This CA cert is Trusted by the user's browser.

Now I create 2 certs, one with SAN: DNS Name=valid.com and the other with SAN: DNS Name=fake.com, both signed by the CA. I configure my local DNS to associate these domains with localhost.

Then I configure the web service to use the "fake" cert and visit fake.com. It gives me an error "The certificate has an invalid name. The name is not included in the permitted list or is explicitly excluded.", which is good, although for some reason the error is shown by Windows over the CA certificate:

enter image description here

Then I configure the web service to use the "valid" cert and visit valid.com, which is supposed to be accepted. But I get exactly the same error in the same conditions.

What is it going wrong in here?

Improve this question
2
  • Where did you install the CA cert. There are multiple stores you can install the CA cert in windows and if it wasn't installed the right store it will be recognized as a site certificate instead of a CA certificate and therefore will not allow sub certs to be recognized.
    – Nick W.
    Commented Jul 9, 2018 at 13:02
  • I would double-check that the server is sending the 'valid.com' certificate
    – Ángel
    Commented Aug 13, 2023 at 22:33

1 Answer 1

Reset to default
0

Pretty sure it should be

DNS Name=.valid.com

to allow the subtree.

https://www.sysadmins.lv/blog-en/x509-name-constraints-certificate-extension-all-you-should-know.aspx has more information.

Improve this answer
1
  • But sorry, one question - I am using "valid.com" directly, without "www.valid,com" or similar... So it doesn't seem the subtree is needed. Also in the link (I have seen it before) it says "DNS = contoso.com ; allows *.contoso.com, for example, www.contoso.com"
    – user1156544
    Commented Feb 9, 2018 at 11:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .