search

FiloSottile / mkcert

A simple zero-config tool to make locally trusted development certificates with any names you'd like.
https://mkcert.dev
BSD 3-Clause "New" or "Revised" License
48.83k stars 2.52k forks source link

possibility to limit down the rootCA on a specific domain #377

Open krtschmr opened 3 years ago

krtschmr commented 3 years ago

we use this for our test-environments (QA testing) and distribute the certificate across the engineering team. they have to import the rootCA in order to be able to have ssl working on our test environments. However, having a rootCA that's valid for the whole internet allows for MITM attacks within our company network (or any other an attacker has control which we would use).

In order to mitigate this, i want to limit down the rootCA to one domain only (*.our-test-company.co). Does mkcert -install provide any options on this or shall i generate my own rootCA, limited on domain, which i then place into the rootCA path?

krtschmr commented 3 years ago

One way of doing it would be in this tutorial: https://systemoverlord.com/2020/06/14/private-ca-with-x-509-name-constraints.html

krtschmr commented 3 years ago

i see this was done in https://github.com/FiloSottile/mkcert/pull/309/files which looks fantastic to me. shall we merge it?