5 ms·
Why does Superfish sign new certificates on the fly? Why not just use wildcard certificates?
by wampus 12y ago
Why does Superfish sign new certificates on the fly? Why not just use wildcard certificates?
- einrealist 12y agoThat is possible. But that depends on how TLS clients approve wildcard certificates. Wildcard certificates are considered harmful. And AFAIK, browsers will not accept 'star.star' (correct me if I'm wrong). So if I host a MITM proxy, I at least use FQDNs as subjects. It also works better with revocation lists/protocols. An example for why wildcard certificates are bad is Microsoft. A couple of years ago, they had problems with subdomains which delivered malicious code through hijacked web pages that were hosted on those domains. Microsoft used a wildcard certificate... https://tools.ietf.org/html/rfc6125#section-7.2 https://tools.ietf.org/html/rfc6125#section-7.2