Importing a root CA as a name-constrained CA
Ángel González <[email protected]>
| Newsgroups | gmane.comp.mozilla.crypto |
|---|---|
| Message-ID | <[email protected]> |
Hello all I have an unrestricted CA I would like to trust for *some* domains. The NSS seems to support this. It should be possible to use certutil with the -extNC parameter (missing from [1], btw) to add the name constraint [2] to the legit subtree(s) So I tried with a command like: certutil -A -d . -n foo -i RootCA.pem -extNC as well as creating a new certificate certutil -S -d . -s "CN=Example_$RAND" -n my-ca-cert -x -t "C,C,C" -extNC and also did some guesses about the kind of parameter it might be take (eg. example.com, permittedSubtrees=.example.com), to no avail. In all cases it fails will certutil: unable to decode trust string: SEC_ERROR_INVALID_ARGS: security library: invalid arguments. Looking at the code [3] I would expect it to show a wizard requesting the information (just like the other constraints, such as -2). I used certutil from nss 3.23 Has someone successfully used name constraints with nss? What parameters should I be using? [1] https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/Tools /certutil [2] http://tools.ietf.org/html/rfc5280#section-4.2.1.10 [3] https://hg.mozilla.org/projects/nss/file/dce6ee11ad9c/cmd/certutil/ certext.c#l953 -- dev-tech-crypto mailing list [email protected] https://lists.mozilla.org/listinfo/dev-tech-crypto