5 ms·
Famous question - intranet. We can do dns-01 verification, on intranets (like valid domain). But the downside is our domain would be logged in the certificate
by yeukhon 10y ago
Famous question - intranet.
We can do dns-01 verification, on intranets (like valid domain). But the downside is our domain would be logged in the certificate transparency log. What is the downside of being on the log?
- spikengineer 10y agoWhether you like it or not, all certs in the near future from all providers will be logged anyway. Most sysadmin don't like their intranet adresses being in the log so as to not provide intel to intruders.
- yeukhon 10y agoAh. I didn't realize we will eventually. So if I get a cert for *.dev.example.com I am exposing just dev.example, but not foo.dev.example.com?
- eeZi 10y agoYes, the log is static. It only contains the subject name if the certificate. But there's little to fear from exposing internal domain names. DNS names are more or public knowledge - they are transmitted unencrypted, end up in plenty of caches etc. Attackers can probably brute force it or the PTR records anyway.
- drdaeman 10y agoIf you don't expose your intranet resources to the outside world, you can probably set up your CA. With proper measures (non-exportable key on a HSM, stored in a safe, requires a PIN that only senior security staff knows, etc etc), it may even improve security for some attack scenarios - if someone gains control of your DNS servers for a short while, they won't be able to issue anything.
- yeukhon 10y agoCan you elaborate where does the HSM come into play with the DNS verification? I am not following. thanks.
- drdaeman 10y agoI was comparing two possible scenarios: a) you have set up your own internal CA, which key is safely stored on an HSM, with all security measures. b) you use Let's Encrypt, and they issue you certificates based on DNS validation. With (b) if malicious party gains control over your DNS server, they can issue themselves a bunch of valid certificates that you may not even know about (unless you watch CT records). With (a) remote attacker barely has a chance. Thus, a self-hosted CA may be beneficial in terms of security.