3

I am trying to do something similar to what has been pointed out in this nice answer by Jonathon Reinhart.

I have a CA certificate with Name Constrains (RFC):

Permitted
     [1]Subtrees (0..0):
          DNS Name=valid.com
Excluded=None

Actually, I would like to prevent the CA from signing any other cert that can do a serverAuth, so I used a white list (would it be possible to have a Excluded = * ? how?)

This CA cert is Trusted by the user's browser.

Now I create 2 certs, one with SAN: DNS Name=valid.com and the other with SAN: DNS Name=fake.com, both signed by the CA. I configure my local DNS to associate these domains with localhost.

Then I configure the web service to use the "fake" cert and visit fake.com. It gives me an error "The certificate has an invalid name. The name is not included in the permitted list or is explicitly excluded.", which is good, although for some reason the error is shown by Windows over the CA certificate:

enter image description here

Then I configure the web service to use the "valid" cert and visit valid.com, which is supposed to be accepted. But I get exactly the same error in the same conditions.

What is it going wrong in here?

  • Where did you install the CA cert. There are multiple stores you can install the CA cert in windows and if it wasn't installed the right store it will be recognized as a site certificate instead of a CA certificate and therefore will not allow sub certs to be recognized. – Nick W. Jul 9 '18 at 13:02
0

Pretty sure it should be

DNS Name=.valid.com

to allow the subtree.

https://www.sysadmins.lv/blog-en/x509-name-constraints-certificate-extension-all-you-should-know.aspx has more information.

  • But sorry, one question - I am using "valid.com" directly, without "www.valid,com" or similar... So it doesn't seem the subtree is needed. Also in the link (I have seen it before) it says "DNS = contoso.com ; allows *.contoso.com, for example, www.contoso.com" – user1156544 Feb 9 '18 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.