3 ms·

Some CAs (Amazon) allow not publishing to the Certificate Transparency Log. But if you do this, browsers will block the connection by default. Chromium browsers

Some CAs (Amazon) allow not publishing to the Certificate Transparency Log. But if you do this, browsers will block the connection by default. Chromium browsers have a policy option to skip this check for selected URLs. See: CertificateTransparencyEnforcementDisabledForURLs. Some may find this more desirable than wildcard certificates and their drawbacks.

klntsky 2y ago
> Some may find this more desirable Why?
- thedougd 2y ago
  A CISA article on wildcard security risks. Some of this is in part from common misimplementations (e.g.reusing private keys across servers), but not all of it. https://www.cisa.gov/news-events/alerts/2021/10/08/nsa-releases-guidance-avoiding-dangers-wildcard-tls-certificates-and https://www.cisa.gov/news-events/alerts/2021/10/08/nsa-relea... Direct: https://media.defense.gov/2021/Oct/07/2002869955/-1/-1/0/CSI_AVOID%20DANGERS%20OF%20WILDCARD%20TLS%20CERTIFICATES%20AND%20THE%20ALPACA%20TECHNIQUE_211007.PDF https://media.defense.gov/2021/Oct/07/2002869955/-1/-1/0/CSI...
navigate8310 2y ago
To avoid subdomain discovery, I usually acquire certificate domain level and add a wildcard SAN.
- luv2code 2y ago
  Will you send me an invite to tildes?
snailmailman 2y ago
Firefox is currently rolling out the same thing. They will treat any non-publicly-logged certificate as insecure. I’m surprised amazon offers the option to not log certificates. The whole idea is that every issued cert should get logged. That way, fraudulently-issued certs are either well documented in public logs- or at least not trusted by the browser.
- fc417fc802 2y ago
  It doesn't seem like the choice has any impact on that. It just protects user privacy if that's what they want to prioritize. Depending on the issuer logging all certs would never work. You can't rely on the untrusted entity to out themselves for you. The security comes from the browser querying the log and warning you if the entry is missing. In that sense declining to log a cert is similar to self signing one. The browser will warn and users will need to accept. As long as the vast majority of sites don't do that then we maintain a sort of herd immunity because the warnings are unexpected by the end user.
  - thedougd 2y ago
    I should have included in my post, this technique only makes sense in the context of private or internal endpoints.

klntsky 2y ago

> Some may find this more desirable Why?

thedougd 2y ago
A CISA article on wildcard security risks. Some of this is in part from common misimplementations (e.g.reusing private keys across servers), but not all of it. https://www.cisa.gov/news-events/alerts/2021/10/08/nsa-releases-guidance-avoiding-dangers-wildcard-tls-certificates-and https://www.cisa.gov/news-events/alerts/2021/10/08/nsa-relea... Direct: https://media.defense.gov/2021/Oct/07/2002869955/-1/-1/0/CSI_AVOID%20DANGERS%20OF%20WILDCARD%20TLS%20CERTIFICATES%20AND%20THE%20ALPACA%20TECHNIQUE_211007.PDF https://media.defense.gov/2021/Oct/07/2002869955/-1/-1/0/CSI...

navigate8310 2y ago

To avoid subdomain discovery, I usually acquire certificate domain level and add a wildcard SAN.

luv2code 2y ago
Will you send me an invite to tildes?

snailmailman 2y ago

Firefox is currently rolling out the same thing. They will treat any non-publicly-logged certificate as insecure. I’m surprised amazon offers the option to not log certificates. The whole idea is that every issued cert should get logged. That way, fraudulently-issued certs are either well documented in public logs- or at least not trusted by the browser.

fc417fc802 2y ago
It doesn't seem like the choice has any impact on that. It just protects user privacy if that's what they want to prioritize. Depending on the issuer logging all certs would never work. You can't rely on the untrusted entity to out themselves for you. The security comes from the browser querying the log and warning you if the entry is missing. In that sense declining to log a cert is similar to self signing one. The browser will warn and users will need to accept. As long as the vast majority of sites don't do that then we maintain a sort of herd immunity because the warnings are unexpected by the end user.
- thedougd 2y ago
  I should have included in my post, this technique only makes sense in the context of private or internal endpoints.