Unfortunately it's not possible to limit the ability of that CA to create valid certificates for any arbitrary domain, at least not on all platforms, see https://bugs.chromium.org/p/chromium/issues/detail?id=407093

And? What's the problem there?

if you install a company internal CA, a rogue syadmin can create perfectly valid certificates for any domain,.including your bank's

Which is a perfect example of why you shouldn't use work equipment for personal traffic.

Or, you are the CEO/CFO/whatever and don't want syadmins of one particular department to compromise your access to your company's bank account.

I think you're oversimplifying.

There are other scenarios you can imagine where it's not a good idea to let one security domain bleed into another.

All the more reason you wouldn't let a third party CA sign certificates for your bank. Seriously, this is and has always been the weakest point of PKI. We have known instances of bad google.com certificates in the wild, as well as certificates being backdated to meet hash requirements.

An internal CA is simply not the problem here, particularly since you can audit your admins' actions.

>> [..] Yes, every company should have an internal trusted CA. I have no idea why there are people arguing against that.

> An internal CA is simply not the problem here, particularly since you can audit your admins' actions.

If you can properly audit your admins' actions, then that's indeed not a problem.

It's easier said than done; I just tried to mention a few reasons why a lot of people suggest (IMHO rightfully so) that perhaps it's not something just about every company should do.

In particular, it's you don't just have to ensure that the CA is properly defended from outside threats only.

Before letsencrypt we didn't have any choice, but now the landscape is really different and in many cases I believe a company could easily defer dealing with an internal CA, especially after https://letsencrypt.org/2017/07/06/wildcard-certificates-com...

FWIW, certificate pinning (HPKP) and efforts like Certificate Transparency are attempts to address or at least mitigate weaknesses of the PKI system.

OK but if I can't audit my own sysadmin's actions how in the WORLD am I going to audit the actions of the sysadmins of the 150+ organizations that my distro has decided can be trusted to sign certificates for any domain? I still fail to see where a third-party CA brings any value whatsoever here.

edit: also, since android 7.0, user defined CA certificates work only on apps that explicitly allow it (source: https://support.google.com/nexus/answer/2844832?hl=en)

The CEO/CFO wants the traffic to be auditable and all company traffic go through a proxy anyway.