5 ms·

If the website is using Let's Encrypt then any subdomains using it will be in certificate transparency logs anyway (until it supports wildcard certificates).

by nsgi 9y ago

nawtacawp 9y ago
Even if they were registered/requested separately? For example, I have mail.domain.com as a separate cert than my domain.com both with letsencrypt.
- kdbg 9y ago
  Yes, of course. The idea of certificate transparency logs is to be able to audit all of the certificates issued by a CA to detect mistakenly or maliciously issued certificates. You can go ahead and search the logs yourself through google. https://transparencyreport.google.com/https/certificates https://transparencyreport.google.com/https/certificates
throwaway613834 9y ago
Do you know how to find out which certificate issuers DON'T submit certs to transparency logs? Is there a list somewhere?
- tialaramex 9y ago
  Not logging certificates will eventually cause them not to be trusted in Chrome. The deadline was pushed back but it hasn't done away. Firefox doesn't have a firm intent to do the same but it's developing all the technology. So this is probably not a good idea. Even where a subscriber specifically didn't want their certs logged and the CA doesn't currently log everything if there's ever a problem it'll get logged. This is because both Google and Mozilla will ask to see all the affected certificates, and logging them is the easiest way to satisfy this requirement. If a CA seems to be trying to dodge this usually participants will take whatever form the CA did provide and upload it to the logs. Google's logs don't care who gives them a cert, they can independently determine that it's authentic so they'll log it.
  - throwaway613834 9y ago
    Yeah, but I feel there's at least like a 30%+ chance that their attempt to make this mandatory will stop in its tracks. I just don't see corporations being okay with it.
    - jlgaddis 9y ago
      There's some work (in the CA/B?) to allow "redacting" certain information from CT logs. I don't recall all the details but I do remember reading an e-mail thread (maybe linked from HN?) about it in just the last week or so.
    - tialaramex 9y ago
      Mandatory logging is a necessary element of the CT design. What we have today is basically like the trial demo of the game. Full CT requires the completion of "gossip protocols", log auditor third parties which detect inconsistencies and a bunch of other stuff that exists today only in the laboratory, you haven't seen the half of it. The option left open by the Chrome team was what's called redaction. The logged document would be partly redacted by for example removing host names. It's not impossible that redaction will happen and end up being accepted, but its biggest proponent was Symantec, who are exiting the business after destroying trust by not exercising proper oversight on their relationship with Korea's CrossCert. And frankly the redaction proposed was getting ludicrous anyway. The trouble is that people who most want this, as with Brass Plate companies, aren't just looking to avoid excess publicity. What they want is to act entirely with impunity. And that's exactly what CT is there to prevent.
    - gsich 9y ago
      Why? If you are in a corporation and don't want to show your hosts in the CT logs, don't use CAs then. In a company I don't see a problem with rolling out certificates with an own CA.
      - throwaway613834 9y ago
        Because you want your employees to be able to easily access a domain externally without unnecessarily advertising its existence to the entire planet?
- regecks 9y ago
  Symantec presently give you the option to redact the labels on precertificates. I think they are the only ones because RFC 6962 does not actually support redaction. Symantec say they are only submitting these entries to the deneb.ws.symantec.com CT log, but it is possible to cross-post redacted log entries to other CT logs, which actually is happening and is kind of annoying. You can see an example of a redaction (for nsw.gov.au) here: https://crt.sh/?id=49265178 https://crt.sh/?id=49265178 I think the best way to protect your privacy currently is to purchase wildcards, though LE will support wildcards next year :) ! Kind of related, I also wrote https://ausdomainledger.net/ https://ausdomainledger.net/ a couple of weeks ago that is crawling CT logs and Common Crawl as well to enumerate domains in the .au zone, because the zone file is not accessible for the ccTLD.
  - throwaway613834 9y ago
    Ah, thanks! Yeah, currently I'm just waiting for LE's wildcard support, but then it hit me there might be others who don't even submit the 2nd-level domain to CT, which I'd prefer if possible.

If the website is using Let's Encrypt then any subdomains using it will be in certificate transparency logs anyway (until it supports wildcard certificates).

by nsgi 9y ago

If the website is using Let's Encrypt then any subdomains using it will be in certificate transparency logs anyway (until it supports wildcard certificates).

nawtacawp 9y ago

Even if they were registered/requested separately? For example, I have mail.domain.com as a separate cert than my domain.com both with letsencrypt.

kdbg 9y ago
Yes, of course. The idea of certificate transparency logs is to be able to audit all of the certificates issued by a CA to detect mistakenly or maliciously issued certificates. You can go ahead and search the logs yourself through google. https://transparencyreport.google.com/https/certificates https://transparencyreport.google.com/https/certificates

throwaway613834 9y ago

Do you know how to find out which certificate issuers DON'T submit certs to transparency logs? Is there a list somewhere?

tialaramex 9y ago
Not logging certificates will eventually cause them not to be trusted in Chrome. The deadline was pushed back but it hasn't done away. Firefox doesn't have a firm intent to do the same but it's developing all the technology. So this is probably not a good idea. Even where a subscriber specifically didn't want their certs logged and the CA doesn't currently log everything if there's ever a problem it'll get logged. This is because both Google and Mozilla will ask to see all the affected certificates, and logging them is the easiest way to satisfy this requirement. If a CA seems to be trying to dodge this usually participants will take whatever form the CA did provide and upload it to the logs. Google's logs don't care who gives them a cert, they can independently determine that it's authentic so they'll log it.
- throwaway613834 9y ago
  Yeah, but I feel there's at least like a 30%+ chance that their attempt to make this mandatory will stop in its tracks. I just don't see corporations being okay with it.
  - jlgaddis 9y ago
    There's some work (in the CA/B?) to allow "redacting" certain information from CT logs. I don't recall all the details but I do remember reading an e-mail thread (maybe linked from HN?) about it in just the last week or so.
  - tialaramex 9y ago
    Mandatory logging is a necessary element of the CT design. What we have today is basically like the trial demo of the game. Full CT requires the completion of "gossip protocols", log auditor third parties which detect inconsistencies and a bunch of other stuff that exists today only in the laboratory, you haven't seen the half of it. The option left open by the Chrome team was what's called redaction. The logged document would be partly redacted by for example removing host names. It's not impossible that redaction will happen and end up being accepted, but its biggest proponent was Symantec, who are exiting the business after destroying trust by not exercising proper oversight on their relationship with Korea's CrossCert. And frankly the redaction proposed was getting ludicrous anyway. The trouble is that people who most want this, as with Brass Plate companies, aren't just looking to avoid excess publicity. What they want is to act entirely with impunity. And that's exactly what CT is there to prevent.
  - gsich 9y ago
    Why? If you are in a corporation and don't want to show your hosts in the CT logs, don't use CAs then. In a company I don't see a problem with rolling out certificates with an own CA.
    - throwaway613834 9y ago
      Because you want your employees to be able to easily access a domain externally without unnecessarily advertising its existence to the entire planet?
regecks 9y ago
Symantec presently give you the option to redact the labels on precertificates. I think they are the only ones because RFC 6962 does not actually support redaction. Symantec say they are only submitting these entries to the deneb.ws.symantec.com CT log, but it is possible to cross-post redacted log entries to other CT logs, which actually is happening and is kind of annoying. You can see an example of a redaction (for nsw.gov.au) here: https://crt.sh/?id=49265178 https://crt.sh/?id=49265178 I think the best way to protect your privacy currently is to purchase wildcards, though LE will support wildcards next year :) ! Kind of related, I also wrote https://ausdomainledger.net/ https://ausdomainledger.net/ a couple of weeks ago that is crawling CT logs and Common Crawl as well to enumerate domains in the .au zone, because the zone file is not accessible for the ccTLD.
- throwaway613834 9y ago
  Ah, thanks! Yeah, currently I'm just waiting for LE's wildcard support, but then it hit me there might be others who don't even submit the 2nd-level domain to CT, which I'd prefer if possible.