3 ms·
Ask HN: Do CAs disclose domain details of all issued certificates?
I recently used letsencrypt for the first time and thought I'd have a certificate for each of multiple subdomains, where subdomains include e.g. dev. and staging.
Just about to launch a new website, googled the main domain to see if it'd been indexed, and discovered, to my horror, that each subdomain is shown as a result on a certificate details website, with the subdomain as the page title.
The subdomains are all 403 with an IP whitelist, with some basic authentication on top, but even having these subs listed exposes more info than I'd like.
Has anyone else experienced this? Could this be a feature peculiar to letsencrypt?
Any tips on preventing this happening again without resorting to wildcard certificates or dedicated development domains, and perhaps on removing references to subdomains from search engines?
Thanks
- detaro 11y agoYou can choose a CA that isn't part of Certificate Transparency[0] and hope that it doesn't become a standard, which it probably will. https://www.certificate-transparency.org/ https://www.certificate-transparency.org/ If you can't live with your domain names being exposed you'll have to get a wildcard or pick less meaningful domain names.
- emma_b 11y agoThanks. Learned something new today.