I looked through attacks in my access logs

Re:I looked through attacks in my access logs by bombcar on Sunday January 28, 2024 @12:16PM (#39167712)

There's really no reason to avoid wildcard certs for your domains, unless you have so many subdomains that are managed by various business interests.

I use LE wildcard certs and they're great, you can use them internally.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by couchand on Sunday January 28, 2024 @01:31PM (#39168388)

It seems like the principle of least power would apply here. There's value in restricting capability to no more than strictly necessary. Consider the risk of a compromised some-small-obscure-system.corporate.com in the presence of a mission-critical-system.corporate.com when both are issued wildcard certs.

Wildcard certs are indeed a valuable tool, but there is no free lunch.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by baobun on Sunday January 28, 2024 @05:24PM (#39170428)

You'd usually put a reverse proxy exposing the services and terminating TLS with the wildcard cert.

The individual services can still have individual non-wildcard internal-only certs signed by an internal CA. These don't need to touch an external CA or appear in CT logs - only the reverse proxy/proxies should ever hit these, and can be configured to trust the internal CA (only) explicitly.

[ Parent | on HN ]