3 ms·

does anyone care that letsencrypt and other CAs are sharing their certificate requests to indexers? It allows someone to discover every one of your HTTPS certi

does anyone care that letsencrypt and other CAs are sharing their certificate requests to indexers? It allows someone to discover every one of your HTTPS certificates that you've requested. For instance, here is some free rabbitmq clusters to use... https://censys.io/certificates?q=parsed.extensions.subject_alt_name.dns_names%3A+rabbitmq https://censys.io/certificates?q=parsed.extensions.subject_a... Default password of guest/guest works on http://rabbitmq.avtomain-crypto.com/#/ http://rabbitmq.avtomain-crypto.com/#/

gsich 7y ago
You can use a wildcard cert too. With other possible issues.
Operyl 7y ago
Yes I do care, and I agree that they should be doing so: I expect that CAs share these to Certificate Transparency logs, it’s a requirement to so that we can accurately find misissued certificates.
tialaramex 7y ago
I have some tremendously bad news if you thought that publicly accessible services on the Internet are secret. Several distinct outfits sell what they call "passive DNS" which is a feed of snooped DNS queries and their answers, minus any identifying information. So you don't need a certificate, if anybody, anywhere, looks up the name and it has an answer then these systems will tell you what it is. The records come through roughly like this: name: 'news.ycombinator.com' type: 'A' value: '209.216.230.240'