3 ms·
Awesome, so when can SSL certs be valid signers for all subdomains now that it can't be abused at the level of tld?
by infogulch 13y ago
Awesome, so when can SSL certs be valid signers for all subdomains now that it can't be abused at the level of tld?
- delinka 13y agoDo you mean like a wildcard certificate? http://en.wikipedia.org/wiki/Wildcard_certificate http://en.wikipedia.org/wiki/Wildcard_certificate
- hwatson 13y agoWildcard certificates are only valid for the subdomain level directly under it. [1] If I get a wildcard certificate for example.com (the common name is set to *.example.com), foo.bar.example.com will throw an error. [1] https://en.wikipedia.org/wiki/Wildcard_certificate#Limitation https://en.wikipedia.org/wiki/Wildcard_certificate#Limitatio...
- duskwuff 13y agoThe specification isn't particularly clear, but it seems to me that RFC 2818 section 3.1 [1] could permit some dangerously broad wildcards like ".com", "www..com", or even ".". Combined with subject alternate names, it may be possible to create a certificate that's valid for almost anything. [1]: http://tools.ietf.org/html/rfc2818#section-3.1 http://tools.ietf.org/html/rfc2818#section-3.1
- jasomill 13y agoIIRC, top-level and "match all" wildcard certificates were originally permitted by design (e.g., for intranet and proxy applications), but most modern browsers block them for security reasons.
- bitexploder 13y agoYou may find this interesting: http://www.digicert.com/internal-names.htm http://www.digicert.com/internal-names.htm (sunsetting of internal name certificates)