I'm trying to implement an internal CA. For this to work other people in the organization need to install the CA on their computers. In case the key is leaked, the atacker won't compromise only the internal domains but will be able to generate certificates for any imaginable domains like gmail.com or github.com and the people in organization would trust them.
I want to ask if there's a way to create the CA and declare the domains it's allowed to generate certificates for? eg. the CA is trusted to sign certificates only for *.acme.internal.