Subject: [pkix] RFC 5280/6818 X.509v3 DNS Name Constraints

From: Vyronas Tsingaras <[email-masked]>
Date: Thu, 27 Mar 2014 10:17:24 +0200

What is the reasoning behind name constraints format for type "DNS name" 
as specified in RFC 5280 <tel:5280>? In other words why is it different 
from the URI scheme, where ".example.com <http://%E2%80%9C.example.com>" 
would satisfy *.example.com <http://example.com>, *.*example.com 
<http://example.com> BUT not example.com <http://example.com>? Currently 
as it stands, a CA has no way to restrict itself from issuing 
certificates for example.com <http://example.com> while allowing itself 
to issue for host.example.com <http://host.example.com>. A NC for type 
DNS "example.com <http://%E2%80%9Cexample.com>" will allow the CA to 
issue a certificate for example.comwhen the desired behavior would be to 
only allow ".example.com <http://%E2%80%9C.example.com>"(in URI 
scheme).  This could be undesirable. It seems like while the scheme for 
URIs and email where updated whereas the DNS scheme was left untouched. 
Wouldn't it be better if the DNS scheme followed the other 2?

The relevant section is 4.2.1.10 <http://4.2.1.10> in RFC 5280 <tel:5280>