Re: Name Constraints, was Re: [caops-wg] Re: ca signing policy file

"Cowles, Robert D." writes:

that the middleware includes a check of the CA when it compares on DN, then what you say is correct.

This is one of the essential problems with this service that has never been addressed as far as I know. name constraints "be" an incomplete barrier. BTW, we have found this omission _useful_ in our past. We switched from a test, development lab CA (DOE Science Grid) to a production quality CA (doegrids), and we used this property to ease subscribers' transition to the new CA. Lesson? Overlapping name spaces might be useful!