It doesn't have to, you can set X509 name constraints which say "the CA may only issue/may not issue certificates for these Subjects," or you can set CAA in DNS, for example.

(Of course, the former isn't really intended to constrain trusted Root CAs, moreso internal PKIs. But it is an option people should know about!)

▲

eqvinox 4 hours ago | parent [-]

To my knowledge, name constraints are very rare in actual use, and a bunch of implementations don't even support them. Am I wrong?

▲

arcfour 3 hours ago | parent [-]

Rare in public PKIs, yes; not so much in private ones, I would imagine.

From my limited experience (using them at home) they seem to be fairly well supported in client libraries, actually!

- OpenSSL has full support, https://docs.openssl.org/master/man5/x509v3_config/

- GnuTLS has full support, https://www.gnutls.org/manual/html_node/X509-certificate-API...

- go (crypto/x509) supports everything except DirectoryName constraints, https://pkg.go.dev/crypto/x509#Certificate.Verify

- Python (pyca/cryptography) has full support, https://cryptography.io/en/stable/x509/reference/#cryptograp...

- Windows/Schannel has full support, https://learn.microsoft.com/en-us/windows/win32/seccertenrol...

- Java has full support, https://docs.oracle.com/en/java/javase/21/docs/api/java.base...

- I know that NSS also supports them from experience but (sorry!) couldn't find the docs in a few seconds of searching

- I know that Strongswan supports them well because I actually opened an issue about it a few years back and got it fixed :-)

(Just a few off the top of my head)

	▲	eqvinox 3 hours ago \| parent [-]
		Wow, Thanks for digging up/working out that support list! Actually a glint of hope. …but, yeah, the issue is on layer 9. Even just nailing sub-CAs to ccTLDs breaks the moment a marketing person registers a .lol domain. Then again, the CA/B is essentially a layer 9 entity. I just refuse to believe this is an unsolvable problem (though it might need NCv2 with a whole bunch more shit to cover more human creativity in policymaking.)