0

If by mistake I have shared the details like Common Name, Serial number, etc.. of the certificate of my intranet site/server that is not exposed to the internet will it help attackers exploit the system?

Improve this question
6
  • 1
    I don't understand the question. Certificates are public. Everything in a certificate is public. (I'm assuming this is a cert for a website): if I visit your website in my browser, the website will hand me its certificate which contains all that information. Why are you concerned about this?
    – Mike Ounsworth
    Commented May 11, 2016 at 16:47
  • What you are saying is for external websites but my concern is if the website is not exposed to internet & is intranet site, what are all the possibilities this might help in an attack/inject a code by those who are exposed to these details?
    – AnotherAdmin
    Commented May 11, 2016 at 16:55
  • @AnotherAdmin then you need to include these details in your question.
    – schroeder ♦
    Commented May 11, 2016 at 16:56
  • edited for clarity about intranet, removed redundant question, put information from their comment into the question.
    – Robert Mennell
    Commented May 11, 2016 at 16:57
  • Edited & updated the question, apologies for the lack of information :(
    – AnotherAdmin
    Commented May 11, 2016 at 16:59

2 Answers 2

Reset to default
4

Those is publicly available information. They are contained in the certificate and you "leak" them to all clients.

What exactly are you concerned about?

Your certificate is meant to be public.

Edit for the edited question:

Yes, those things can make the life of an attacker easier.

  • the CN can leak the naming scheme for the network
  • the CA can leak information on how it can be breached or impersonated
  • the validity gives a rough time slot for when it will most likely be rolled over.

Yet, for all these informations to be useful, an external attacker would need to have access to your internal network.

Other security measures should prohibit this - and if the attacker has access, the data is again more or less public.

The biggest "leak" from my point of view is the naming scheme of the intranet. That makes the discovery process easier for an attacker.

Yet, nothing to freak out about - especially since the client will probably dispose of the information more or less instantly.

Improve this answer
2
  • I meant to say is the certificate belongs to intranet website
    – AnotherAdmin
    Commented May 11, 2016 at 17:10
  • 1
    Note that with Certificate transparency logs, your certificate could be recorded publicly forever (for example all EV certificates will be required to be logged publicly, and Let's Encrypt certificates already are logged publicly)
    – Tom
    Commented May 11, 2016 at 21:15
1

In general, certificates are meant to be public. The idea of a certificate containing secret information doesn't really make sense.

That being said, the certificate does contain information about the topology of your intranet (domain names of the servers, CN of your internal CA, etc). Maybe this gives attackers an advantage, maybe it doesn't. If your firewalls are blocking external access to the intranet then it's irrelevant.

Bottom line: There's no crypto or network security reason why this is a problem. It does give attackers some information about the server structure of your intranet. Whether or not this is a problem is something you'll have to decide for yourself - we can't make that call for you.

For example, if the CN of the server contains the name of top secret research project then there's intellectual properly leakage here. If, on the other hand, the CN is like cn=exchange server, dc=myCompany, dc=com then the attacker now knows that you use Outlook for your email. Big deal.

Improve this answer
2
  • Thanks Mike, let's say if that information is exposed, so how do we mitigate it? changing the certificate, will it help?
    – AnotherAdmin
    Commented May 11, 2016 at 17:17
  • You asked a question that was very sparse on details, but you're looking for a detailed and specific answer. You're not going to get a detailed answer about what to do when you haven't told us very much about what information is in the DNs, what applications these servers are running, what your network topology is like, how your firewalls are set up, and so on. Based on what you've given us, the only real answer is "I don't know, I can't make that decision for you".
    – Mike Ounsworth
    Commented May 11, 2016 at 17:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .