News for hackers. Stuff that matters.

A comment on I looked through attacks in my access logs. Parent comment

Re:I looked through attacks in my access logs by couchand on Sunday January 28, 2024 @01:31PM (#39168388)
It seems like the principle of least power would apply here. There's value in restricting capability to no more than strictly necessary. Consider the risk of a compromised some-small-obscure-system.corporate.com in the presence of a mission-critical-system.corporate.com when both are issued wildcard certs.

Wildcard certs are indeed a valuable tool, but there is no free lunch.

[ Parent | on HN ]
Re:I looked through attacks in my access logs by baobun on Sunday January 28, 2024 @05:24PM (#39170428)
You'd usually put a reverse proxy exposing the services and terminating TLS with the wildcard cert.

The individual services can still have individual non-wildcard internal-only certs signed by an internal CA. These don't need to touch an external CA or appear in CT logs - only the reverse proxy/proxies should ever hit these, and can be configured to trust the internal CA (only) explicitly.

[ Parent | on HN ]