5 ms·
You can't put anything in the SubjectAltName field, you can put anything that isn't a valid TLD (and not have to validate it).
by iancarroll 12y ago
You can't put anything in the SubjectAltName field, you can put anything that isn't a valid TLD (and not have to validate it).
- im2w1l 12y agoSo Eve could also get a cert for facebookcorewwwi.onion?
- iancarroll 12y agoYes. I submitted a request for one just now, actually. Hopefully the CA doesn't flag it for containing Facebook.
- iancarroll 12y agoJust had it issued. Probably going to write a blog post now.
- AmustheGreat 12y agoDid you get it from DigiCert? Or from another CA?
- iancarroll 12y agoGlobalSign. edit: They've revoked the cert. :(
- mike_hearn 12y agoBut does TBB check for revocations? I bet the answer is no because otherwise it'd be sending the sites you visit to CA's via OCSP and Tor would never want that. So I think you still win.
- e12e 12y agoYou could still get a full revocation list (via Tor or not). In fact using OCSP over Tor should be safe? FB sees some-exit-node, sends you a cert, CA sees some-other-or-same-but-not-provably-you requesting status of FBs cert. Unless FB sent you a specially craftet, session-spesific cert, CA would only see that "someone" checked the status of FBs cert. And with no immediate link between "you" and "someone"? Much as DNS over Tor is safe (but DNS over udp isn't)?
- e12e 12y agoWhat a shame I didn't put a bunch of likely new TLDs into a cert before they became valid TLDs... ;-)
- iancarroll 12y agoDo note CAs have to revoke all certs within 30 days of ICANN signing a contract with a new TLD provider.