Comment Comment by throw0101d > Forcing their customers to install government-affiliated alternative CAs, in turn allowing the government to spy on its citizens more easily via mis-issued certs?How's the support for X.509 "Name Constraints" these days:* https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1....Would restricting it to only dot-ir domains be a mitigation?* https://en.wikipedia.org/wiki/.ir parent throw0101d 1 month ago
How's the support for X.509 "Name Constraints" these days:
* https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1....
Would restricting it to only dot-ir domains be a mitigation?
* https://en.wikipedia.org/wiki/.ir