5 ms·

I'm curious how many SSL implementations will accept it (assuming you signed it with a trusted root/self-signed certs are allowed)

mike_d 6y ago
None. Wildcards are not allowed at the first or second level. https://en.wikipedia.org/wiki/Wildcard_certificate#Examples https://en.wikipedia.org/wiki/Wildcard_certificate#Examples
- ryan-c 6y ago
  Nor are they permitted anywhere other than in the leftmost part of the name. *.*.example.com and foo.*.example.com aren't allowed. Not sure what the current state of software accepting these things is, but minimally, CAs are not allowed to issue anything like that.
  - SiempreViernes 6y ago
    So are we pretty certain or very certain that at least one implementation (probably in an IoT device) will no bother with this validity check and accept it anyway?
    - floatingatoll 6y ago
      Do network routers count as IoT devices?
    - ryan-c 6y ago
      100% certain, but it's self signed, so no mainstream browser will honor it.
- rndgermandude 6y ago
  The question wasn't whether if it is allowed, but how many implementations will actually accept it ;)
  - tialaramex 6y ago
    Popular browsers don't accept these prohibited names, e.g. here's the relevant code for Mozilla's NSS: security/nss/lib/mozpkix/lib/pkixnames.cpp Likewise for Chromium: trunk/src/net/base/x509_certificate.cc (I've intentionally not linked these because burdening the relatively heavyweight source viewers with idle HN readers who are mostly going to glaze over and not read once they discover it's tricky C++ code seems unfair) My guess would be that because it's harder to process multiple wildcards at all, and indeed even the sketchy single wildcard in odd position (which Symantec used to issue and argued wasn't technically prohibited e.g. dev-*.auditcompany.example where auditcompany.example was a domain belonging to Symantec's auditors...) it's less likely anybody goes to the effort to do this even though it's a bad idea. But I guess if the wrong programmer is assigned the problem they might cheerfully write a nice loop to process wildcards even though it's more effort and the wrong thing so we can't rule out that it has happened somewhere at least once.
    - tolqen 6y ago
      > I've intentionally not linked these because burdening the relatively heavyweight source viewers with idle HN readers who are mostly going to glaze over and not read once they discover it's tricky C++ code seems unfair Seems like a good use case for linking to their respective GitHub mirrors
      - vlz 6y ago
        > Seems like a good use case for linking to their respective GitHub mirrors https://github.com/chromium/chromium/blob/master/net/cert/x509_certificate.cc#L518 https://github.com/chromium/chromium/blob/master/net/cert/x5... https://github.com/mozilla/gecko-dev/blob/master/security/nss/lib/mozpkix/lib/pkixnames.cpp https://github.com/mozilla/gecko-dev/blob/master/security/ns...
        snazz 6y ago
        Although I will say that the code-browsing experience on https://source.chromium.org https://source.chromium.org beats GitHub by a mile; you can hover over anything, the search tools are better, and it makes it easier to actually understand the code you're reading.

mike_d 6y ago

None. Wildcards are not allowed at the first or second level. https://en.wikipedia.org/wiki/Wildcard_certificate#Examples https://en.wikipedia.org/wiki/Wildcard_certificate#Examples

ryan-c 6y ago
Nor are they permitted anywhere other than in the leftmost part of the name. *.*.example.com and foo.*.example.com aren't allowed. Not sure what the current state of software accepting these things is, but minimally, CAs are not allowed to issue anything like that.
- SiempreViernes 6y ago
  So are we pretty certain or very certain that at least one implementation (probably in an IoT device) will no bother with this validity check and accept it anyway?
  - floatingatoll 6y ago
    Do network routers count as IoT devices?
  - ryan-c 6y ago
    100% certain, but it's self signed, so no mainstream browser will honor it.
rndgermandude 6y ago
The question wasn't whether if it is allowed, but how many implementations will actually accept it ;)
- tialaramex 6y ago
  Popular browsers don't accept these prohibited names, e.g. here's the relevant code for Mozilla's NSS: security/nss/lib/mozpkix/lib/pkixnames.cpp Likewise for Chromium: trunk/src/net/base/x509_certificate.cc (I've intentionally not linked these because burdening the relatively heavyweight source viewers with idle HN readers who are mostly going to glaze over and not read once they discover it's tricky C++ code seems unfair) My guess would be that because it's harder to process multiple wildcards at all, and indeed even the sketchy single wildcard in odd position (which Symantec used to issue and argued wasn't technically prohibited e.g. dev-*.auditcompany.example where auditcompany.example was a domain belonging to Symantec's auditors...) it's less likely anybody goes to the effort to do this even though it's a bad idea. But I guess if the wrong programmer is assigned the problem they might cheerfully write a nice loop to process wildcards even though it's more effort and the wrong thing so we can't rule out that it has happened somewhere at least once.
  - tolqen 6y ago
    > I've intentionally not linked these because burdening the relatively heavyweight source viewers with idle HN readers who are mostly going to glaze over and not read once they discover it's tricky C++ code seems unfair Seems like a good use case for linking to their respective GitHub mirrors
    - vlz 6y ago
      > Seems like a good use case for linking to their respective GitHub mirrors https://github.com/chromium/chromium/blob/master/net/cert/x509_certificate.cc#L518 https://github.com/chromium/chromium/blob/master/net/cert/x5... https://github.com/mozilla/gecko-dev/blob/master/security/nss/lib/mozpkix/lib/pkixnames.cpp https://github.com/mozilla/gecko-dev/blob/master/security/ns...
      - snazz 6y ago
        Although I will say that the code-browsing experience on https://source.chromium.org https://source.chromium.org beats GitHub by a mile; you can hover over anything, the search tools are better, and it makes it easier to actually understand the code you're reading.