Name constraints are part of the X.509 standard and are described in RFC 5280 . They are a tool that can be used as part of qualified subordination to control the scope of a certification authority certificate in a fine-grained manner.
The capolicy.inf contains basic settings that can or should be specified before installing a certification authority. Put simply, no certification authority should be installed without it.
Continue reading "Basics: Configuration file for the certification authority (capolicy.inf)"
A useful hardening measure for certification authorities is to restrict the certification authority certificates so that they are only trusted for the extended key usages (Extended Key Usage) that are actually issued.
In the event of a compromise of the certification authority, the damage is then (at least) limited to the defined extended key usages.
The Smart Card Logon Extended Key Usage, which is of interest for many attacks (in conjunction with the certification authority's membership in NTAuthCertificates ) would then only be present in the certification authority certificate of the certification authority that actually issues such certificates.