Say I want to get a certificate for my domain, and say that I don't want this to result in the name of my domain appearing in certificate transparency logs or similar locations. (The domain is only for my personal use, and I neither need nor want to advertise it to the whole world.)

What are my options? Do most providers generally submit certificates to transparency logs?
Or do all domains that end up getting SSL/TLS certificates automatically end up on such logs?

I would use a self-signed certificate, but that won't work, because I need to use a third-party service and it needs to be able to authenticate my domain.

Ideally they would be cheap like Let's Encrypt, but I don't even know what my options are.

(Yes, I'm aware DNS logs exist regardless, and I know obscurity isn't security, etc. That's not the point of my question, so please refrain from offering advice on that...)

closed as off-topic by Xander, Stephane, John Deters, Purefan, Rory Alsop Mar 15 '17 at 15:34

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – Xander, Stephane, John Deters, Purefan, Rory Alsop
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    If the domain is for your personal use what about using a self-signed cert and importing it in your device's trust stores? – André Borie Jan 8 '17 at 16:22
  • 2
    You have very aggressively said what you don't want but you haven't explained why you think you need what you want. I think you would get much better answers if you explained a bit better. – Julian Knight Jan 8 '17 at 19:54
  • 1
    @JulianKnight: Does my last comment not explain it? Like I said, I'm trying to use a third party service on my domain. Said party only provides its service over HTTPS and only to the root (no way to specify paths, etc.), so I need a verifiable certificate. But it's a personal domain and nobody else needs to know that it exists. I don't want to get a new domain name just because of this, and regardless, I would still have to advertise that which I prefer not to do if I don't need to. If it's impossible to do what I'm asking then that's a valid answer. I think this should be clear? – Mehrdad Jan 8 '17 at 23:09
  • 1
    In that case, you can possibly redirect your domain through Cloudflare. Use their HTTPS service which delivers valid certs for any domain used via them. Use your self-signed cert to secure the connection between your server and Cloudflare and make sure that you restrict access to your server so only CF connections will make it through. – Julian Knight Jan 8 '17 at 23:47
  • 2
    The problem is that the whole point of the web is to expose domains to discovery. The only way to avoid that is to only use IP addresses but that would take you back to using self-signed certs only. I don't think you can really do what you want as you want it. I'm only guessing really that CF would leave less of a footprint than your own registered cert. – Julian Knight Jan 9 '17 at 7:29

The best solution for a subdomain is a wildcard certificate:

To protect secretdomain.example.com, get a *.example.com certificate. But it's expensive. The wildcard could be submitted to ct logs, but it will not reveal the real domain name.

The two other solution are:

  • using a CA that don't sumbit certificates to ct logs, but anybody visiting your website could submit your certificate. (some bots crawl the web do to it)
  • using a CA that submit to ct logs with name redaction, but browsers do not yet understant it, it's at your own risk.

Another possibility is to transform secretdomain.com to notsecretdomain.com/secretdomain: with that you avoir ct logs, DNS logs, and even https leaks (when using https, the path is protected, but not the domain)

  • The first thing you mentioned is a brilliant idea, except here the issue here is I don't want the second level domain in the logs either (in fact the third level one is benign). For the other two solutions, which CAs don't submit to such logs? I have no idea how to even find out, that's kind of why I asked this question. And regarding the last solution, it doesn't work since I need a third party service to be able to verify my domain. – Mehrdad Jan 8 '17 at 18:18
  • "Which CQs don't submit themselves to CT logs" is another (good) question. You should ask it. And for information: "Certificate Transparency Will Be Mandatory in Chrome" securityintelligence.com/news/… so any answer will only be valid until that... Another point: is that domain is only for your private use, maybe you could use a self signed certificate? – Tom Jan 8 '17 at 18:47
  • 1
    Regarding self-signed, see my earlier comment on my question. And I'm not looking for a list of CAs necessarily, that's just one particular way to answer the question. You could also just tell me how to figure it out myself or something. Figuring out how to go about this was the purpose of this question, so it's kind of defeating the purpose for me to ask another one. – Mehrdad Jan 8 '17 at 18:50

Not the answer you're looking for? Browse other questions tagged or ask your own question.