4 ms·
> from a time before certificate transparency logs ruined that anyway. Isn't it possible under WebPKI rules to get an intermediate cert for all of your subdoma
by jcranmer 3y ago
> from a time before certificate transparency logs ruined that anyway.
Isn't it possible under WebPKI rules to get an intermediate cert for all of your subdomains so that only the intermediate cert needs to get logged in certificate transparency? Or at the very least, you could use a wildcard underneath the domain you own...
- woodruffw 3y agoI don’t think CAB would prevent that kind of intermediate, but I don’t know of any CA that issues them. The domain set would need to be enforced with name constraints, which are notoriously buggy in a lot of validators. But yes, a wildcard accomplishes the same thing, and I think that’s the route (almost?) everyone goes if a service’s subdomains really need to be kept out of a transparency log.
- hsbauauvhabzb 3y agoI was under the impression you could flag your domain to not be in cert transparency logs. Security through obscurity is generally considered a bad idea (to which I think exceptions or nuance exist), but the likelihood of dns names being burnt via other mechanisms (isps/‘security’ products and platforms logging dns requests and selling them being a reasonable assumption).
- woodruffw 3y agoI don’t believe this is true. CT is wholly encompassing by design: if you could somehow opt out, an attacker could use that mechanism to bypass CT. (As far as I know, the only way to “opt out” is to use a wildcard to obscure the true subdomain being accessed.) Edit: from a quick look online, CT became mandatory for CA issued certificates in the Web PKI in 2018.