5 ms·

How could you validate wildcards without changing DNS? And the different value every three months thing is definitely a feature not a bug, because otherwise st

by ratorx 5y ago

How could you validate wildcards without changing DNS? And the different value every three months thing is definitely a feature not a bug, because otherwise stale values could lead to mis-issuance.

TekMol 5y ago
How could you validate wildcards without changing DNS? The same way you validate ownership of a subdomain: By putting stuff into the well-known path. Only that you do it for the root domain. I don't know any case where someone has control over the root domain but is not eligible for a wildcard cert.
- nrmitchi 5y ago
  > I don't know any case where someone has control over the root domain but is not eligible for a wildcard cert. Companies very very often point their root domain at a hosting company for their marketing site; let's use Netlify as an example. This does NOT mean that I would expect Netlify to be able to issue wildcard certs for my domain. Basic "www-izer" (redirection) services are another example where the root domain is pointed somewhere that should not be able to issue wildcard certs.
  - TekMol 5y ago
    To deal with this, a DNS entry "Root Domain Controls Wildcarts" could be required for the validation.
- tialaramex 5y ago
  This loose allowance is going away. Current BRs allow using 3.2.2.4.18 and 3.2.2.4.19 (Agreed upon change to Website) for wildcards until December 2021. After that: > For Certificates issued on or after 2021‐12‐01, the CA MUST NOT issue Certificates for other FQDNs that end with all the labels of the validated FQDN unless the CA performs a separate validation for that FQDN using an authorized method. This method is NOT suitable for validating Wildcard Domain Names. Let's Encrypt are just ahead of the curve here, this was always unsafe because it means if your corporate site https://big-corp.example/ https://big-corp.example/ is on some bulk host that bulk host can get (even though presumably they wouldn't) wildcard certificates that will also match mail.big-corp.example and db2.big-corp.example and auth.big-corp.example and vpn.big-corp.example ...
account42 5y ago
Having control over the HTTP response for the root domain but not being authorized to have SSL certificates over subdomains is already a veriry dubious concern, but if you are that worried you could define a fixed DNS record saying that for this particular domain ownership verification of the main domain translates to all subdomains.
- nrmitchi 5y ago
  > Having control over the HTTP response for the root domain but not being authorized to have SSL certificates over subdomains is already a veriry dubious concern What about marketing/static hosting sites like Netlify/Vercel/etc? I can point my domain there. That does not mean they should be authorized to have wildcard certs over the whole domain.
  - nathancahill 5y ago
    Hmm, isn't that exactly how they work?
    - remram 5y ago
      CDNs are a bad example, because they usually deal with DNS as well. They usually want to send different replies in different regions, etc. CloudFlare is the only one I used, but I know you can't set it up before you switch to their name servers. However say you host your root-name website on GitHub pages or similar. You don't want them to have full DNS control over the rest of your zone (emails, app, etc).
    - nrmitchi 5y ago
      No, they work by being able to issue a cert for the specific domain that is pointed at them. It does not work by allowing them to issue a wildcard cert for the entire domain. For example, `nrmitchi.com` is pointed at Netlify. Netlify can obtain a certificate for `nrmitchi.com` (and `www.nrmitchi.com`, which is also pointed at them). It does not allow Netlify to obtain a cert for `*.nrmitchi.com`, nor should it.

by ratorx 5y ago

How could you validate wildcards without changing DNS? And the different value every three months thing is definitely a feature not a bug, because otherwise stale values could lead to mis-issuance.

TekMol 5y ago

How could you validate wildcards without changing DNS? The same way you validate ownership of a subdomain: By putting stuff into the well-known path. Only that you do it for the root domain. I don't know any case where someone has control over the root domain but is not eligible for a wildcard cert.

nrmitchi 5y ago
> I don't know any case where someone has control over the root domain but is not eligible for a wildcard cert. Companies very very often point their root domain at a hosting company for their marketing site; let's use Netlify as an example. This does NOT mean that I would expect Netlify to be able to issue wildcard certs for my domain. Basic "www-izer" (redirection) services are another example where the root domain is pointed somewhere that should not be able to issue wildcard certs.
- TekMol 5y ago
  To deal with this, a DNS entry "Root Domain Controls Wildcarts" could be required for the validation.
tialaramex 5y ago
This loose allowance is going away. Current BRs allow using 3.2.2.4.18 and 3.2.2.4.19 (Agreed upon change to Website) for wildcards until December 2021. After that: > For Certificates issued on or after 2021‐12‐01, the CA MUST NOT issue Certificates for other FQDNs that end with all the labels of the validated FQDN unless the CA performs a separate validation for that FQDN using an authorized method. This method is NOT suitable for validating Wildcard Domain Names. Let's Encrypt are just ahead of the curve here, this was always unsafe because it means if your corporate site https://big-corp.example/ https://big-corp.example/ is on some bulk host that bulk host can get (even though presumably they wouldn't) wildcard certificates that will also match mail.big-corp.example and db2.big-corp.example and auth.big-corp.example and vpn.big-corp.example ...

account42 5y ago

Having control over the HTTP response for the root domain but not being authorized to have SSL certificates over subdomains is already a veriry dubious concern, but if you are that worried you could define a fixed DNS record saying that for this particular domain ownership verification of the main domain translates to all subdomains.

nrmitchi 5y ago
> Having control over the HTTP response for the root domain but not being authorized to have SSL certificates over subdomains is already a veriry dubious concern What about marketing/static hosting sites like Netlify/Vercel/etc? I can point my domain there. That does not mean they should be authorized to have wildcard certs over the whole domain.
- nathancahill 5y ago
  Hmm, isn't that exactly how they work?
  - remram 5y ago
    CDNs are a bad example, because they usually deal with DNS as well. They usually want to send different replies in different regions, etc. CloudFlare is the only one I used, but I know you can't set it up before you switch to their name servers. However say you host your root-name website on GitHub pages or similar. You don't want them to have full DNS control over the rest of your zone (emails, app, etc).
  - nrmitchi 5y ago
    No, they work by being able to issue a cert for the specific domain that is pointed at them. It does not work by allowing them to issue a wildcard cert for the entire domain. For example, `nrmitchi.com` is pointed at Netlify. Netlify can obtain a certificate for `nrmitchi.com` (and `www.nrmitchi.com`, which is also pointed at them). It does not allow Netlify to obtain a cert for `*.nrmitchi.com`, nor should it.