Skip to content
master
Switch branches/tags
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
 
 
 
 

crosssignnameconstraint

This tool applies a name constraint exclusion to a DER-encoded TLS trust anchor via cross-signing. The intended use case is to disallow a CA from issuing certificates for a domain name that it has no legitimate business issuing certificates for. For example:

  • Disallowing a public CA from issuing certificates for the .bit TLD used by Namecoin.
  • Disallowing a public CA from issuing certificates for a TLD controlled by your corporate intranet.
  • Disallowing your corporate intranet's CA from issuing certificates for a TLD allocated by ICANN.

It currently only supports a single DNS domain name exclusion (because that's all that Namecoin needed). Pull requests that add additional flexibility for the name constraints (e.g. multiple exclusions, permitted DNS domain names, or non-DNS domain names) would be happily accepted and appreciated (even if it breaks API backward-compatibility).

Requirements

crosssignnameconstraint requires Go 1.10.0 or higher. Please note that crosssignnameconstraint will build in Go 1.9.x, but will behave incorrectly (and we cannot guarantee that this incorrect behavior won't introduce security issues).

Projects who use crosssignnameconstraint

Send a pull request if you'd like to be included.

Licence

crosssignnameconstraint is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

crosssignnameconstraint is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with crosssignnameconstraint. If not, see https://www.gnu.org/licenses/.

About

Apply a name constraint to an X.509 trust anchor via cross-signing, without that trust anchor's consent.

Resources

License

Packages

No packages published