I'm trying to set permitted name constraints on a private CA certificate. For example, I have the following constraints on my root certificate

X509v3 Name Constraints: critical

I've issued a certificate for another domain anothertestdomain.local. Both the Common Name and Subject Alternative Names are set to that domain. When testing validation for that certificate, OpenSSL and Firefox both fail with a Permitted Subtree Violation as expected. Chrome, however, accepts that certificate. Is this expected under Chrome?

I'm testing with Chromium on Linux.

  • 1
    I've tried this on IE11, Edge, Chrome on Windows, Firefox on Linux, Chrome on Linux and Chromium on Linux and all browsers complain if I have a name constraint in the final CA in the chain. – garethTheRed Apr 18 at 7:47

You can use BetterTLS to check the Name Constraints support of various clients. It's open source and made by the Netflix team.

BetterTLS is a test suite for HTTPS clients implementing verification of the Name Constraints certificate extension.

It works for the browser and for non-browser clients (like Java and Python).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.