Many organizations (e.g. companies, universities, ...) have internal sites and services for which they use SSL certificates issued by an internal CA, that isn't trusted by browsers or operating systems by default. Usually, all potential users (e.g. staff, students) of these services are known, and thus can be instructed to install the internal CA's root certificate on their devices. (Or, for devices provided by the organization to the users, the organization's IT department might install the root certificate as part of the setup.)
Usually, all services with such internal-CA-issued certificates are on (subdomains of) one or at least only few domains. Despite that, the internal CA usually has a root cert able to sign arbitrary certificates. (I.e., a root cert not using the Name Constraints
extension to voluntarily limit itself.)
When installing such a root certificate as a user, can I limit the acceptance to a set of domains I specify and their subdomains? If yes, how? I'd like to install the root cert, so that I don't have to tell my browser to make an exception for each and every individual certificate or service, but I'd still like to not enable the organization to unnoticed break open my SSL traffic to external (i.e. third party) services and websites, which they could easily do when I'm accessing those through their network. (E.g. accessing https://security.stackexchange.com/ from work.)
For the sake of this question, let's assume that
- I have full control over the client device (e.g. a BYOD laptop or smartphone)
- I'm allowed to deviate from the root cert installation instructions (if any)
- while the organization and/or its IT department are in a position to break open outgoing SSL traffic originating in their network, they are supposed to not do so and it's also not expected they would do so without prior notice (i.e., I as a user am not expected to let my SSL traffic be broken open, even when/while in the organization's network)
In case it matters for the "how" part of the question: I'm using Mozilla Firefox on Linux (specifically NixOS), but I'd also be interested in solutions that are applicable to other setups.