# Could LE new Root allow eventual Name Restricted Sub issuance **URL:** \ **Category:** Issuance Policy\ **Created:** [October 16, 2020, 5:26am UTC](https://community.letsencrypt.org/t/could-le-new-root-allow-eventual-name-restricted-sub-issuance/136131 "2020-10-16T05:26:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![spocklogical](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/spocklogical/32/36741_2.png) [@spocklogical](https://community.letsencrypt.org/u/spocklogical)\ **Post date:** [October 16, 2020, 5:26am UTC](https://community.letsencrypt.org/t/could-le-new-root-allow-eventual-name-restricted-sub-issuance/136131/1 "2020-10-16T05:26:16Z")
I'm not sure how the adoption of Name Constraints has been, but does LE's new Root contribute anything towards a path to name constrained subordinates? Does it give LE complete control over chain length? It's also been 2 years since the last post I could find about [Permitted Subtrees with Name Constraints](https://community.letsencrypt.org/t/support-for-permittedsubtree-name-constraints/80415) and 4 since [the one that got a statement from LE](https://community.letsencrypt.org/t/sign-me-as-an-intermediate-ca-for-my-domain-with-name-constraint/17140), I'm curious if anything has changed since as far as BRs restrictions or Name Constraints adoption? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [October 16, 2020, 6:15am UTC](https://community.letsencrypt.org/t/could-le-new-root-allow-eventual-name-restricted-sub-issuance/136131/2 "2020-10-16T06:15:32Z")
> [@spocklogical](#): > > I'm not sure how the adoption of Name Constraints has been (…) You're referring to the Baseline Requirements here I'm guessing? That's something you could check yourself 🙂 > [@spocklogical](#): > > (…) but does LE's new Root contribute anything towards a path to name constrained subordinates? I don't think there's any difference between the current `ISRG Root X1` (RSA) and the new `ISRG Root X2` (ECDSA) when it comes to name constrained subordinates. Why would there? > [@spocklogical](#): > > (…) I'm curious if anything has changed since as far as BRs restrictions or Name Constraints adoption? I'm not familiair with any change, but you can check for yourself: [Baseline Requirements for TLS Server Certificates – CAB Forum](https://cabforum.org/baseline-requirements-documents/) ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [October 16, 2020, 8:10am UTC](https://community.letsencrypt.org/t/could-le-new-root-allow-eventual-name-restricted-sub-issuance/136131/3 "2020-10-16T08:10:10Z")
by the way how hard to run and manage Technically Restrained CA?(assume someone willing to sign one)? self audit still needed, so it need 3% of certificates zlinted and check against its own CPS, so I guess it still need full size CA software like boulder or [EJBCA](https://www.ejbca.org/)? or things like CFSSL can make enough log for it? and does it use parent's CA for CAA record? are they need to publish it's leaf certificate to CT logger? ---
**Author:** ![spocklogical](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/spocklogical/32/36741_2.png) [@spocklogical](https://community.letsencrypt.org/u/spocklogical)\ **Post date:** [October 16, 2020, 11:02am UTC](https://community.letsencrypt.org/t/could-le-new-root-allow-eventual-name-restricted-sub-issuance/136131/4 "2020-10-16T11:02:23Z")
@Osiris, thanks! Google wasn't super helpful in directing me to relevant key words to research more on this. I brought up the new root because I remember seeing someone mention that the old root was restricted to certain number of subordinates/chain length. So to summarize what I think the [latest spec said at 7.1.5, 8.1, and 8.7](https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.7.2.pdf) a constrained subordinate CA still has to have at least 3% of its issued certificates manually audited quarterly by its issuing CA without there being any clear way to automate it. Unless there could be a way to automate it to the CABF's satisfaction. ---
**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\ **Post date:** [October 16, 2020, 12:28pm UTC](https://community.letsencrypt.org/t/could-le-new-root-allow-eventual-name-restricted-sub-issuance/136131/5 "2020-10-16T12:28:49Z")
that 3% audit applys to full-ca too, so I guess there is way to automate that, like here. there is no way ISRG hire people to look at 3% of certs ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 15, 2020, 12:28pm UTC](https://community.letsencrypt.org/t/could-le-new-root-allow-eventual-name-restricted-sub-issuance/136131/6 "2020-11-15T12:28:58Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.