On: Chrome will mark all HTTP sites as ‘not secure’ starting in July

[projct]

adding a local CA means you can middleman anything you want to, seems like something that should be difficult to do, to me.

[zokier → projct]

Name constraints are a thing. Local CA should be constrained to signing only local names (roughly matching dhcp domain-name/domain-search options).

[detaro → zokier]

Name constraints are not universally supported in browsers sadly.

[deathanatos → detaro]

And this should be fixed. Name constraints would be incredibly useful for a number of things, if only they were supported.

[detaro → deathanatos]

I believe Apple is the holdout in this case, meaning Safari and Chrome on MacOS don't support it.