Re:Wildcard Certificates Coming January 2018
by overint on Thursday July 06, 2017 @08:29PM
(#14715074)
Would you not be exposing those subdomains via DNS anyway?
Re:Wildcard Certificates Coming January 2018
by chtitux on Friday July 07, 2017 @07:10AM
(#14717514)
You can't enumerate sub domains via DNS (except if you use DNSSEC with NSEC algorithm, but nobody do that).
It does not prevent people guesssing it tough.
Re:Wildcard Certificates Coming January 2018
by tptacek on Friday July 07, 2017 @02:36PM
(#14720874)
Correction: you can also enumerate through NSEC3, the most common (and default) mode of deployment; NSEC3 turns enumerable zone entries into the equivalent of a password hash file, which can be cracked.
There's a hack to prevent this that seeds the zone with false entries, but it requires the server to operate as an online signer. Since this is essentially incoherent to the design of the protocol (which makes major cryptographic and usability sacrifices to enable offline signers), there's an "NSEC4" being worked on now.
DNSSEC is silly.
If you use customer1.mycorp.com, customer2.mycorp.com, etc. the names of your clients is exposed twice :
- if you issue one certificate with all the domains, all the domains are readable in the certificate (Cloudflare free cert. has this issue too)
- all the LE certificates are published in Certificate Transparency logs. So you can detect if anyone issues a cert. for your domain, but anyone can view the certificates you issued.
With a wildcard certificate, the subdomains used are not public.
Note this issue applies to "internal" subdomains too. You probably don't want to expose the hostname of your backoffice (admin.mycorp.com) or your new top secret project (linux.microsoft.org).