4 ms·
It is also useful to rely more on wildcard certs, as it makes it difficult to determine from CT logs the specific subdomains to attack.
by elashri 3y ago
It is also useful to rely more on wildcard certs, as it makes it difficult to determine from CT logs the specific subdomains to attack.
- bombcar 3y agoThere's really no reason to avoid wildcard certs for your domains, unless you have so many subdomains that are managed by various business interests. I use LE wildcard certs and they're great, you can use them internally.
- couchand 3y agoIt seems like the principle of least power would apply here. There's value in restricting capability to no more than strictly necessary. Consider the risk of a compromised some-small-obscure-system.corporate.com in the presence of a mission-critical-system.corporate.com when both are issued wildcard certs. Wildcard certs are indeed a valuable tool, but there is no free lunch.
- baobun 3y agoYou'd usually put a reverse proxy exposing the services and terminating TLS with the wildcard cert. The individual services can still have individual non-wildcard internal-only certs signed by an internal CA. These don't need to touch an external CA or appear in CT logs - only the reverse proxy/proxies should ever hit these, and can be configured to trust the internal CA (only) explicitly.
- nullindividual 3y agoA compromised wildcard certificate has a much higher potential for abuse. The strong preference in IT security is a single-host or UCC (SAN) certificate. Renewing a wildcard is also unfun when you have services which require a manual import.
- dfc 3y agoRenewing any certificate that requires a manual import is not fun. Why are wildcard certs less fun to manually import than individual certificates?
- nullindividual 3y agoPresumably one purchases a wildcard for multiple distinct systems.
- dfc 3y agoUsing them like that never occurred to me. I was thinking multiple sites on one host or vanity hostnames: dfc.example.com / nullindividual.example.com. etc.
- nullindividual 3y agoUnless you're running some sort of automated system to churn out vanity host names (like an Azure or AWS would to provide you an OOTB URI), a UCC/SAN cert is a better choice. More restrictive is better than less restrictive when it comes to certificates.
- stefandesu 3y agoYeah, I switched to wildcard certs at some point for this reason.