Re: charter revisions

[Steve Hanna <steve.hanna@xxxxxxx>]

"Hallam-Baker, Phillip" wrote:
> > Name constraints allow you to limit the "bad things" that happen. You
> > can trust MIT to certify MIT affiliates without worrying about whether
> > they might issue a certificate claiming to be for George W. Bush.
> 
> No you can't.
> 
> You can prevent someone from issuing a certificate that claims to
> be for C=US; O=Government; OU=EOP; CN=George W Bush.
> 
> What you can't do is to stop someone from issuing a subjectAltName
> for potus@xxxxxxxxxxx

Use a name constraint with permitted subtrees of:
 rfc822Name:mit.edu

-Steve