8.3 Name Constraints
Restrict the namespace a private CA is allowed to issue for.
Name constraints bound the namespace a CA is permitted to issue for. A CA constrained to internal.example.com and 10.0.0.0/8 cannot issue a certificate for login.example.com or a public IP address — even if the CA itself were misused. For a CA that will be trusted across your fleet, constraints are the primary security surface area boundary.
Syntax
Constraints are defined when the CA is created, one entry per line:
| Entry type | Example | Matches |
|---|---|---|
| DNS suffix | internal.example.com |
internal.example.com itself and any name beneath it: app.internal.example.com, *.internal.example.com |
| IP range (CIDR) | 10.0.0.0/8 |
Any IP address SAN within the range. IPv4 and IPv6 are both supported. |
internal.example.com
corp.local
10.0.0.0/8
Semantics
Constraints follow RFC 5280 permitted subtrees semantics:
- Only permitted entries are supported; there are no exclusions. Anything not matched by an entry is rejected.
- A name type with no entries is unconstrained. If you list only DNS suffixes, IP address SANs are not restricted, and vice versa. To restrict both, list at least one entry of each type.
For example, with the constraint list above:
| Requested SAN | Result |
|---|---|
db01.corp.local |
Issued |
*.internal.example.com |
Issued |
www.example.com |
Rejected — outside every DNS suffix |
10.4.20.11 |
Issued |
203.0.113.9 |
Rejected — outside the permitted range |
Enforcement
Constraints are enforced in two independent layers:
- In the certificates. The constraint set is embedded in the CA certificates as a critical X.509 Name Constraints extension, so relying parties that process constraints enforce them independently of CertKit. Modern TLS stacks — Windows, OpenSSL, Go, and the major browsers — all honor name constraints.
- At issuance. CertKit validates every certificate request against the CA’s constraints before signing and refuses out-of-scope names. This applies even where the extension is absent from the certificate chain — notably Bring Your Own Root subordinates whose signing CA stripped the requested extension.
Name constraints are fixed for the life of the CA. To change a CA’s scope, create a new CA with the desired constraints.