3 ms·
As opposed to just using the wildcard itself?
by mholt 8y ago
As opposed to just using the wildcard itself?
- ozim 8y agoYou know wildcard is not working two levels down, you are getting .yourdomain.com but not .*.yourdomain.com. But yea maybe parent poster could consider scheme: git-internal.yourdomain.com.
- michaelt 8y agoIf one of Google's servers gets hacked, I'd rather the hacker get the mail-sor-f41.google.com certificate than the *.google.com certificate :)
- mholt 8y agoBut certificates are PUBLIC keys...
- majewsky 8y agoIt's evident that GP is referring to the private keys.
- mholt 8y agoNo, it's not.
- 420codebro 8y agoLet's say a single VM or docker container has a break-out exploit. They get the private key for (whatever).domain.tld. It would be nice to be able to issue whatever yourself, rather than having to A) do wildcards or B) expose every single record to CT. But I personally don't tie privacy to DNS. Best systems I've seen which handle sensitive stuff have very ambiguous DNS names which you would never guess what they really are.
- tracker1 8y agoAnd how would one use the cert on a server for a secure connection without the corresponding PRIVATE key exactly?