On 9 Oct 2026, at 16:15, Ralph Seichter <[email protected]> wrote:
>> Is this kind of sub-CA a service that some certificate authorities >> provide ? > > Interesting question. From the perspective of operating a small and > unknown-to-the-wider-world Root CA myself, I would never allow a third > party to use an Intermediary CA of mine to sign certificates. I could > not control how, when and for whom this third party hands out certs -- > and all of those would be chain-signed with my Root CA. Not going to > happen here. > > I would be surprised if some Organisation XYZ, which went through the > significant effort and cost of establishing a well-known and respected > Root CA, handed out intermediate CAs to others. I'm assuming Kurt was trying to find out whether "real" CAs are willing to hand out CA certificates with a name constraint (https://www.rfc-editor.org/info/rfc5280/#section-4.2.1.10 ) to third parties. It would be very nice to have something like that. Maybe letsencrypt or a competitor could stop doing silly things*, and actually add a feature that allows the general public to start using encrypted email with s/mime.</mini-rant> Anyway, I'm only aware of people using this with a private CA, where it is then used to limit the CA to signing internal hostnames only. That way, it is not possible to abuse such a CA (which will also be installed as a trusted CA on company machines) for mitm ssl proxying. Jasper *) i really appreciate what the people running LE have accomplished so far but a) I'd like a CA with a similar featureset that is not (in the end) controlled by trump, and b) breaking OCSP was really stupid. At least they could have left OCSP stapling as a thing instead of forcing people to go to short-lived certificates. _______________________________________________ mailop mailing list -- [email protected] To unsubscribe send an email to [email protected]
