News for hackers. Stuff that matters.

A comment on Bank Underground, the blog written by Bank of England staff. Parent comment

Re:Bank Underground, the blog written by Bank of England staff by corin_ on Thursday May 05, 2016 @06:00AM (#11634888)
They just chose to have a hosted blog from Wordpress with a custom domain, Wordpress chose to use a Let's Encrypt certificate and to lump a bunch of different customers' custom domains into one certificate request hence the alt names.
[ Parent | on HN ]
Re:Bank Underground, the blog written by Bank of England staff by oarsinsync on Thursday May 05, 2016 @06:04AM (#11634903)
Lots of sites using the same private key. Could this be potentially problematic?
[ Parent | on HN ]
Re:Bank Underground, the blog written by Bank of England staff by tombrossman on Thursday May 05, 2016 @06:15AM (#11634935)
Not really, the host is already trusted (as explained in the parent comment). The domain owner is free to obtain a different certificate with a new private key that only they know if they wish. When you choose to use shared hosting you are already delegating plenty of trust so it's reasonable to use the host's private key.
[ Parent | on HN ]
Re:Bank Underground, the blog written by Bank of England staff by corin_ on Thursday May 05, 2016 @06:11AM (#11634921)
I wouldn't think so... Wordpress keeps the private key themselves the customers won't have access to it.
[ Parent | on HN ]