Subject: [pkix] How to enforce domain constraints on intermediate CA?

From: Jeffrey Walton <[email-masked]>
Date: Sat, 21 Feb 2015 16:50:45 -0500

I have an internal PKI, and I'm trying to figure out how to apply a
policy that constrains names to the one used internally. I've read
through RFCs like 5280, but its not clear to me how to do it.

How does one apply a domain policy constraint to an intermediate CA under PKIX?

---

From: Santosh Chokhani <[email-masked]>
Date: Sun, 22 Feb 2015 00:14:06 +0000

I would think this can be done via using name constraints extension and asserting appropriate DNS name spaces

-----Original Message-----
From: pkix [mailto:[email-masked]] On Behalf Of Jeffrey Walton
Sent: Saturday, February 21, 2015 4:51 PM
To: PKIX
Subject: [pkix] How to enforce domain constraints on intermediate CA?

I have an internal PKI, and I'm trying to figure out how to apply a policy that constrains names to the one used internally. I've read through RFCs like 5280, but its not clear to me how to do it.

_______________________________________________
pkix mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/pkix

---

From: Jeffrey Walton <[email-masked]>
Date: Sat, 21 Feb 2015 20:14:25 -0500

> I would think this can be done via using name constraints extension and asserting appropriate DNS name spaces

Ah, thanks. I was looking for a policy object, and not an extension.
Sorry about that.

Jeff

---

From: "Miller, Timothy J." <[email-masked]>
Date: Mon, 23 Feb 2015 15:29:46 +0000

FWIW, Microsoft Cert Services uses name constraints and other things in intermediate CA certs as part of "qualified subordination."

-- T

> Sent: Saturday, February 21, 2015 7:14 PM
> To: Santosh Chokhani
> Cc: PKIX
> Subject: Re: [pkix] How to enforce domain constraints on intermediate CA?
> 
> > I would think this can be done via using name constraints extension
> > and asserting appropriate DNS name spaces
> 
> > I have an internal PKI, and I'm trying to figure out how to apply a policy that
> constrains names to the one used internally. I've read through RFCs like 5280,
> but its not clear to me how to do it.
> >