3 ms·
I do not understand what you are trying to say. The destination would still be under SNI. Exposing existence is a separate matter, the only thing I can think o
by willstrafach 9y ago
I do not understand what you are trying to say. The destination would still be under SNI.
Exposing existence is a separate matter, the only thing I can think of is that you're referring to those TLS certificates with multiple domains (almost just as bad as a wildcard certificate). Now that TLS certificates are free, each subdomain can indeed have its own certificate, thereby not causing any exposure.
- pixl97 9y agoI think you are missing what is going on. Lets say you have super secret domain xsrihghufgyssw.foo.com, it is published in your DNS and it is publically reachable, but no one ever knows to look up that domain to reach the website. It is almost impossible for someone to randomly stumble upon or guess that domain name. With certificate transparency there is a log of that certificate being registered so if some group like DDOS for hire wanted to take your services out, they could use all those names as targets.
- willstrafach 9y agoTo clarify, the situation is a publicly reachable subdomain which you do not want others to know about?