Hacker News Reader

Comment by philipwhiuk | Hacker News Reader

It would be good to be able to only trust CAs with some TLDs. That would limit the harm for adding a geographically useful CA to only a certain segment of the internet.

View on HN

One of the problems with domain restrictions on CAs is that real world geography has turned out to not correlate with domain name 'geography' for general use. Organizations located in a country (or the EU or etc) will register their domains all over, instead of nicely restricting themselves to something under a single TLD or a small number of them, where they could use a restricted-scope CA. This mostly leaves you with organizational CAs, such as government ones (for the government's sites), and they seem to not have been too popular in practice.

Seems like it would mirror how the registrar system works, where some registrars are able to register most TLDs and some are more regional.

I'm guessing that for some TLDs it would make even more sense like for .gov or .google or similar.

The ability exists. Such constraints aren't used very often for root certificates though, as far as I can tell. The Japanese Government CA which was mentioned in the discussions around TrustCor was constrained to .go.jp.

It needs to be supported in the clients, both browsers and libraries. I'm actually mad that scope restrictions are not more commonly used, and that tooling is absurdly complicated.

It would be useful for internal CAs too, because they could be trusted for only a specific subdomain, eg *.intranet.acme.com.

Reply on news.ycombinator.com