2

We are using an internal Certificate Authority for our company. We noticed that it is possible to add as subjectAltName the hostname without the domain. We are using example.org for internal servers and example.com for external, public facing servers.

E.g. instead of using mysite.example.org, we can create a certificate like:

Subject: CN=mysite.example.org
subjectAltName=DNS.1=mysite.example.org,DNS.2=mysite

In this way people can use https://mysite/ and it will work. The DNS search is example.org and example.com.

I have 3 questions:

  • is it secure?
  • what are the security problems that could be cause by such setup?
  • what is the type of attack that someone could take advantage of this config.

Edit1: It seems that public certificate authorities are moving away from signing certificates using an "internal name": https://cabforum.org/internal-names/ and https://www.digicert.com/internal-names.htm

1

is it secure?

a bit less than FQDN. The problem with short names is name ambiguity. FQDN is unique in public, but not necessary to be in private networks. The problem with short names is name ambiguity and nothing else. It is acceptable to use short names in small private networks, however it is impossible to maintain them in large networks. There is nothing wrong if you use unique short name in private networks. However, there might be an issue when multiple factory-provisioned devices are configured to share the same short name.

what is the type of attack that someone could take advantage of this config.

an attacker still have to spoof name resolution mechanism (DNS for FQDN and NetBIOS for short names) to redirect client to rogue host with the same name.

  • 1
    But the purpose of the server certificate shouldn't be to identify in an unambiguous way the server? Using short name, isn't it like having a corporate badge writing "John Doe" with no other distinctive features? – Mircea Vutcovici Dec 15 '16 at 14:00
  • 1
    The more ambiguites you have, the more chances that the user will connect to improper server. In Internet, each host must be unique within Internet. FQDN solves the problem, while short names raise ambiguity (this is the reason why public CAs do not issue certificates to short names). – Crypt32 Dec 15 '16 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.