<story><title>Search.chatgpt.com domain and SSL cert have been created</title><url>https://search.chatgpt.com</url></story><parent_chain><item><author>filleokus</author><text>I&amp;#x27;m taking this opportunity to once again ask for the widespread adoption of the Name Constraints extension in x509, and subsequent roll-out of constrained intermediate CA certs signed by a publicly trusted root.&lt;p&gt;Would be so convenient to have an intermediate CA cert constrained to *.my-name.com to avoid situations like this. Being forced to either use a private PKI infrastructure or using wildcards to not leak host names is so annoying.</text></item></parent_chain><comment><author>lambdaxyzw</author><text>The point of certificate transparency is to have a public audit log of every certificate issued. Even if you had your own CA, you would be obliged to report every certificate you issue to the CT. This is a feature, not a bug.</text></comment>
<story><title>Search.chatgpt.com domain and SSL cert have been created</title><url>https://search.chatgpt.com</url></story><parent_chain><item><author>filleokus</author><text>I&amp;#x27;m taking this opportunity to once again ask for the widespread adoption of the Name Constraints extension in x509, and subsequent roll-out of constrained intermediate CA certs signed by a publicly trusted root.&lt;p&gt;Would be so convenient to have an intermediate CA cert constrained to *.my-name.com to avoid situations like this. Being forced to either use a private PKI infrastructure or using wildcards to not leak host names is so annoying.</text></item></parent_chain><comment><author>lxgr</author><text>This would be so great. It also just mirrors the DNS trust model nicely, which is what’s used for X.509 trust anyway by most CAs.</text></comment>