[GH-ISSUE #302] [feature] add Name Constraint? #191

New issue

Open

opened 2026-02-25 22:32:49 +03:00 by kerem · 2 comments

kerem commented

2026-02-25 22:32:49 +03:00

Owner

Originally created by @zimbatm on GitHub (Oct 17, 2020).
Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/302

It would be nice if the CA could be generated with a Name Constraint, so that it can only be used on a specific top-level domain like .local.

See https://timothy-quinn.com/name-constraints-in-x509-certificates/

Originally created by @zimbatm on GitHub (Oct 17, 2020). Original GitHub issue: https://github.com/FiloSottile/mkcert/issues/302 It would be nice if the CA could be generated with a Name Constraint, so that it can only be used on a specific top-level domain like `.local`. See https://timothy-quinn.com/name-constraints-in-x509-certificates/

kerem commented

2026-02-25 22:32:50 +03:00

Author

Owner

@ralexander-phi commented on GitHub (Mar 30, 2023):

Just as a heads-up when implementing this. Browsers like Google don't enforce Name Constraint on any manually imported trust roots. For this to work, I believe you need to create an intermediary certificate with the name constraint, and then use that for issuance. Maybe mkcert should destroy the private key of the root cert once the intermediary is created?

@ralexander-phi commented on GitHub (Mar 30, 2023): Just as a heads-up when implementing this. Browsers like Google [don't enforce Name Constraint on any manually imported trust roots](https://bugs.chromium.org/p/chromium/issues/detail?id=1072083). For this to work, I believe you need to create an intermediary certificate with the name constraint, and then use that for issuance. Maybe `mkcert` should destroy the private key of the root cert once the intermediary is created?

kerem commented

2026-02-25 22:32:50 +03:00

Author

Owner

@nh2 commented on GitHub (Oct 18, 2024):

Browsers like Google don't enforce Name Constraint on any manually imported trust roots.

Chrome fixed this, ticket was closed as fixed 2024-07-11.

@nh2 commented on GitHub (Oct 18, 2024): > Browsers like Google [don't enforce Name Constraint on any manually imported trust roots](https://bugs.chromium.org/p/chromium/issues/detail?id=1072083). Chrome fixed this, ticket was closed as fixed 2024-07-11.