News for hackers. Stuff that matters.

A comment on It seems that OpenAI is scraping [certificate transparency] logs. Parent comment

Re:It seems that OpenAI is scraping [certificate transparenc... by bityard on Monday December 15, 2025 @12:24PM (#46277442)
Yep, but this comes with a tradeoff: all of your services now have a valid key/cert for your whole domain, significantly increasing the blast radius if one service is compromised.
[ Parent | on HN ]
Re:It seems that OpenAI is scraping [certificate transparenc... by silverwind on Monday December 15, 2025 @01:31PM (#46278395)
Not a problem if you have the cert on a shared load balancer, not on the services directly.
[ Parent | on HN ]
Re:It seems that OpenAI is scraping [certificate transparenc... by 0127 on Monday December 15, 2025 @02:35PM (#46279309)
This is what we do for development containers/hosts - put them behind *.dev.example.com, allows us to hide most testing instances using a shared load balancer. And with a single wildcard CNAME, No info is leaked in CT logs or DNS. Said LB is firewalled, but why pay for extra traffic that's just going to be blocked?
[ Parent | on HN ]
Re:It seems that OpenAI is scraping [certificate transparenc... by nh2 on Monday December 15, 2025 @10:05PM (#46284281)
Is it technically possible to obtain a wildcard cert from LetsEncrypt, but then use OpenSSL / X.509 tooling to derive a restricted cert/key to be deployed on servers, which only works for specific domains under the wildcard?
[ Parent | on HN ]
Re:It seems that OpenAI is scraping [certificate transparenc... by alphager on Wednesday December 17, 2025 @04:31PM (#46305795)
No
[ Parent | on HN ]