3 ms·
A compromised wildcard certificate has a much higher potential for abuse. The strong preference in IT security is a single-host or UCC (SAN) certificate. Renew
by nullindividual 3y ago
A compromised wildcard certificate has a much higher potential for abuse. The strong preference in IT security is a single-host or UCC (SAN) certificate.
Renewing a wildcard is also unfun when you have services which require a manual import.
- dfc 3y agoRenewing any certificate that requires a manual import is not fun. Why are wildcard certs less fun to manually import than individual certificates?
- nullindividual 3y agoPresumably one purchases a wildcard for multiple distinct systems.
- dfc 3y agoUsing them like that never occurred to me. I was thinking multiple sites on one host or vanity hostnames: dfc.example.com / nullindividual.example.com. etc.
- nullindividual 3y agoUnless you're running some sort of automated system to churn out vanity host names (like an Azure or AWS would to provide you an OOTB URI), a UCC/SAN cert is a better choice. More restrictive is better than less restrictive when it comes to certificates.