5 ms·

>And since the 65k servers/appliances (now more like 80k) are located in tens of thousands of different networks, leaking the internal IP isn't bad at all -- es

>And since the 65k servers/appliances (now more like 80k) are located in tens of thousands of different networks, leaking the internal IP isn't bad at all -- especially since there is no way to correlate them with the customer. Maybe not directly - and I say that as a maybe, since I'm not so sure of this premise - but you're leaking a bunch of data this way that can be used by attackers that have some level of information or access to get additional information about the network, the services running on it, etc. The idea that this "isn't bad at all" is pretty much patently false. "Not too bad in most situations" is probably a bit more accurate. >For normal "internal servers" within a company, I'd probably recommend using a wildcard cert and an internal DNS server. Why? For internal servers within the company you can run your own PKI and CA and use an internal cert, giving you much more flexibility and control over things than just using a wildcart cert and internal DNS server would, without much increase in effort. >We went this route to provide a secure web interface to our appliance. The far better option is to give the customer a way to provide their own cert. Or, since you are providing the appliance, have them trust your CA on the machines that are administrating the appliance. I'll be frank: Your choices here and general suggestions around DNS would worry me if I was in the market for your appliance. I would not find it at all acceptable that internal details of my network are leaking out, no matter how convinced you are that it's not bad at all.

lostapathy 8y ago
> Why? For internal servers within the company you can run your own PKI and CA and use an internal cert, giving you much more flexibility and control over things than just using a wildcart cert and internal DNS server would, without much increase in effort. Running an internal CA those days terrifies me, its a hell of a responsibility to keep that secure. People check medical records, financial data, and god knows what else on their work devices, and if your CA is compromised that can all be eavesdropped on. Either by an attacker or disgruntled insider. No thanks.
- alexchamberlain 8y ago
  I think the argument here is given for servers that can only be accessed via an internal network; ie those eavedroppers would have to be on the internal network.
  - michaelt 8y ago
    What lostapathy means is, because X.509 Name Constraints don't work [1], there's no way for Example Inc's administrators to limit their corporate CA to only issue certs for subdomains of example.com So if Example Inc puts their cert on every employee's machine, then a hacker or rogue insider could issue a cert for paypal.com and MITM every employee. Starting an internal CA introduces the risk of this bad thing happening. [1] https://security.stackexchange.com/a/31382 https://security.stackexchange.com/a/31382
- throw0101a 8y ago
  > Running an internal CA those days terrifies me [...] Better not have Active Directory then, because it has a built-in CA used by every Windows client bound to the domain. Technically, X.509 allows for constraining things [1], but from a practical perspective [2] it's not really implemented. [1] https://tools.ietf.org/html/rfc5280#section-4.2.1.10 https://tools.ietf.org/html/rfc5280#section-4.2.1.10 [2] https://security.stackexchange.com/questions/31376/ https://security.stackexchange.com/questions/31376/
  - LIV2 8y ago
    Source on that claim? I know you can install ADCS but it is not installed by default.
    - throw0101a 8y ago
      Not a Windows guy, but I assumed that it was by default. Could be wrong.
- cthalupa 8y ago
  >and if your CA is compromised that can all be eavesdropped on. Either by an attacker or disgruntled insider. No thanks. Get an HSM - they're pretty cheap these days - and store the CA's private key in the HSM. Or an offline CA, if you don't want to deal with the HSM. Or, even better, do both.
  - LIV2 8y ago
    Yep! If you're an absolute tightarse it's even possible to use a smartcard/yubikey as a poor-mans HSM
  - lostapathy 8y ago
    So to better explain my perspective - I'm coming at this from the angle of a consultant to small to mid sized organizations. Nearly all the times somebody talks about setting up a CA, it's so they can man-in-the-middle all their network traffic to sniff it. Yet the organization struggles to do much more basic things correctly. For better or worse, though, the bias in the comments here are from competent people working for competent orgs - not smaller shops that exist in a perpetual state of garbage fire. So absolutely, yes, you can run your CA reasonably today. But in practice, outside very large and competent enterprise shops (i.e., your typical business) - no. The typical business I bump into struggles with internal DNS and DHCP - the skills just aren't there.

lostapathy 8y ago

> Why? For internal servers within the company you can run your own PKI and CA and use an internal cert, giving you much more flexibility and control over things than just using a wildcart cert and internal DNS server would, without much increase in effort. Running an internal CA those days terrifies me, its a hell of a responsibility to keep that secure. People check medical records, financial data, and god knows what else on their work devices, and if your CA is compromised that can all be eavesdropped on. Either by an attacker or disgruntled insider. No thanks.

alexchamberlain 8y ago
I think the argument here is given for servers that can only be accessed via an internal network; ie those eavedroppers would have to be on the internal network.
- michaelt 8y ago
  What lostapathy means is, because X.509 Name Constraints don't work [1], there's no way for Example Inc's administrators to limit their corporate CA to only issue certs for subdomains of example.com So if Example Inc puts their cert on every employee's machine, then a hacker or rogue insider could issue a cert for paypal.com and MITM every employee. Starting an internal CA introduces the risk of this bad thing happening. [1] https://security.stackexchange.com/a/31382 https://security.stackexchange.com/a/31382
throw0101a 8y ago
> Running an internal CA those days terrifies me [...] Better not have Active Directory then, because it has a built-in CA used by every Windows client bound to the domain. Technically, X.509 allows for constraining things [1], but from a practical perspective [2] it's not really implemented. [1] https://tools.ietf.org/html/rfc5280#section-4.2.1.10 https://tools.ietf.org/html/rfc5280#section-4.2.1.10 [2] https://security.stackexchange.com/questions/31376/ https://security.stackexchange.com/questions/31376/
- LIV2 8y ago
  Source on that claim? I know you can install ADCS but it is not installed by default.
  - throw0101a 8y ago
    Not a Windows guy, but I assumed that it was by default. Could be wrong.
cthalupa 8y ago
>and if your CA is compromised that can all be eavesdropped on. Either by an attacker or disgruntled insider. No thanks. Get an HSM - they're pretty cheap these days - and store the CA's private key in the HSM. Or an offline CA, if you don't want to deal with the HSM. Or, even better, do both.
- LIV2 8y ago
  Yep! If you're an absolute tightarse it's even possible to use a smartcard/yubikey as a poor-mans HSM
- lostapathy 8y ago
  So to better explain my perspective - I'm coming at this from the angle of a consultant to small to mid sized organizations. Nearly all the times somebody talks about setting up a CA, it's so they can man-in-the-middle all their network traffic to sniff it. Yet the organization struggles to do much more basic things correctly. For better or worse, though, the bias in the comments here are from competent people working for competent orgs - not smaller shops that exist in a perpetual state of garbage fire. So absolutely, yes, you can run your CA reasonably today. But in practice, outside very large and competent enterprise shops (i.e., your typical business) - no. The typical business I bump into struggles with internal DNS and DHCP - the skills just aren't there.