3 ms·

Wildcard certificate would not help, that only refers to validity, not destination host.

ceejayoz 9y ago
Wildcards do help. If you've got super-secret-subdomain.example.com, a wildcard for *.example.com doesn't expose its existence. A non-wildcard certificate does. There's a bit of security-via-obscurity going on here, but sometimes the need for such a thing is out of one's control.
- willstrafach 9y ago
  I do not understand what you are trying to say. The destination would still be under SNI. Exposing existence is a separate matter, the only thing I can think of is that you're referring to those TLS certificates with multiple domains (almost just as bad as a wildcard certificate). Now that TLS certificates are free, each subdomain can indeed have its own certificate, thereby not causing any exposure.
  - pixl97 9y ago
    I think you are missing what is going on. Lets say you have super secret domain xsrihghufgyssw.foo.com, it is published in your DNS and it is publically reachable, but no one ever knows to look up that domain to reach the website. It is almost impossible for someone to randomly stumble upon or guess that domain name. With certificate transparency there is a log of that certificate being registered so if some group like DDOS for hire wanted to take your services out, they could use all those names as targets.
    - willstrafach 9y ago
      To clarify, the situation is a publicly reachable subdomain which you do not want others to know about?
- LambdaComplex 9y ago
  Couldn't you use a separate certificate for super-secret-subdomain.example.com?
  - ceejayoz 9y ago
    No: https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency The TL;DR version: Every certificate goes into the log. *.example.com going into the log is no problem for hiding a particular subdomain.
  - willstrafach 9y ago
    Apparently, the intended scenario would be a subdomain which is public accessible but the owner wishes to keep secret, so their concern is actually just the domain existing in CT logs (I am aware that it makes zero sense).

Wildcards do help. If you've got super-secret-subdomain.example.com, a wildcard for *.example.com doesn't expose its existence. A non-wildcard certificate does. There's a bit of security-via-obscurity going on here, but sometimes the need for such a thing is out of one's control.

willstrafach 9y ago
I do not understand what you are trying to say. The destination would still be under SNI. Exposing existence is a separate matter, the only thing I can think of is that you're referring to those TLS certificates with multiple domains (almost just as bad as a wildcard certificate). Now that TLS certificates are free, each subdomain can indeed have its own certificate, thereby not causing any exposure.
- pixl97 9y ago
  I think you are missing what is going on. Lets say you have super secret domain xsrihghufgyssw.foo.com, it is published in your DNS and it is publically reachable, but no one ever knows to look up that domain to reach the website. It is almost impossible for someone to randomly stumble upon or guess that domain name. With certificate transparency there is a log of that certificate being registered so if some group like DDOS for hire wanted to take your services out, they could use all those names as targets.
  - willstrafach 9y ago
    To clarify, the situation is a publicly reachable subdomain which you do not want others to know about?
LambdaComplex 9y ago
Couldn't you use a separate certificate for super-secret-subdomain.example.com?
- ceejayoz 9y ago
  No: https://en.wikipedia.org/wiki/Certificate_Transparency https://en.wikipedia.org/wiki/Certificate_Transparency The TL;DR version: Every certificate goes into the log. *.example.com going into the log is no problem for hiding a particular subdomain.
- willstrafach 9y ago
  Apparently, the intended scenario would be a subdomain which is public accessible but the owner wishes to keep secret, so their concern is actually just the domain existing in CT logs (I am aware that it makes zero sense).