When accepting an SSL certificate, can I limit for which domains I accept it?

Question

Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating systems by default. Usually, all potential users (e.g. staff, students) of these services are known, and thus can be instructed to install the internal CA's root certificate on their devices. (Or, for devices provided by the organization to the users, the organization's IT department might install the root certificate as part of the setup.)

Usually, all services with such internal-CA-issued certificates are on (subdomains of) one or at least only few domains. Despite that, the internal CA usually has a root cert able to sign arbitrary certificates. (I.e., a root cert not using the Name Constraints extension to voluntarily limit itself.)

When installing such a root certificate as a user, can I limit the acceptance to a set of domains I specify and their subdomains? If yes, how? I'd like to install the root cert, so that I don't have to tell my browser to make an exception for each and every individual certificate or service, but I'd still like to not enable the organization to unnoticed break open my SSL traffic to external (i.e. third party) services and websites, which they could easily do when I'm accessing those through their network. (E.g. accessing https://security.stackexchange.com/ from work.)

---

For the sake of this question, let's assume that

• I have full control over the client device (e.g. a BYOD laptop or smartphone)
• I'm allowed to deviate from the root cert installation instructions (if any)
• while the organization and/or its IT department are in a position to break open outgoing SSL traffic originating in their network, they are supposed to not do so and it's also not expected they would do so without prior notice (i.e., I as a user am not expected to let my SSL traffic be broken open, even when/while in the organization's network)

---

In case it matters for the "how" part of the question: I'm using Mozilla Firefox on Linux (specifically NixOS), but I'd also be interested in solutions that are applicable to other setups.

Answer 1

Nope.

At least not in a way which is fun or scales well.

While technically what you want is absolutely possible, practically the infrastructure to cut down permissions from the regular binary "complete unconditional trust"/"no trust at all" to something in between the two extremes is not really there.

While it's a relatively straightforward idea there is just no interface that I know if that would allow you to apply name constraints or other constraints to a CA (or anywhere else on the certificate path).

What you COULD do is manually PIN things. Which is a way of whitelisting exactly what you expect of a certificate chain before you accept an end-entity certificate that is part of that chain. Typically the idea is to PIN (explicitly whitelist) the public key of a cert on the cert chain. -- That's the idea at least. Again there is no great UI. -- However I have come across a Firefox extension in the past that tried to do something roughly similar. However I found it very cumbersome and unpractical. Also I don't know if it's still supported. But if you're really, really determined, you might give it a try: "Certificate Patrol": http://patrol.psyced.org/