2

When looking to purchase an SSL certificate recently I noticed that this vendor was offering subject alternative names (SANs) certificates. When you look at the cert details you can see that all of the extra domains that a cert authenticates.

Image from vendor's site

Surely this is information leakage allowing a would-be hacker to glean more information about your organisation than you intend?

Also, does it not complicate any possible revocation scenarios in that if one host is compromised then they'll all need to be changed?

2

Also, does it not complicate any possible revocation scenarios in that if one host is compromised then they'll all need to be changed?

When the private key (for which the certificate is associated) is compromised, then the certificate(s) for that key are revoked.

Whether or not the certificate applies to a single domain, many Subject Alternative Names (SAN), or is a Wildcard certificate; it is still a single certificate and does not complicate the revocation process.

And supposing there are other certificates for the same domain(s), if they are from different uncomprimised private keys, then those will not be affected by revocation of the aforementioned certificate. Domain name overlap notwithstanding.

Surely this is information leakage allowing a would-be hacker to glean more information about your organisation than you intend?

It is quite possible that a SAN will list a subdomain that could not be found otherwise except by Brute Force, I think in this particular case, these subdomains are probably easily found by other means.

Even if they were intended to be secret, software designers should not rely on the secrecy of their hostname. This is stored in browser history, synced to the cloud, and likely emailed to co-workers.

So the fact that SAN lists these domains might save an attacker some time in finding subdomains, publication of this information is not considered a vulnerability.

The real risk for vulnerability would be in the application, and that is where the security focus should be.

  • Thanks very much for a well-explained, lucid answer with no hyperbole. Much appreciated! – noonand Sep 23 '16 at 9:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.