0

My use-case is the following:

I have dyndns set up to access my home server from the internet. If I use a DV certificate or a self-signed certificate I'm not actually authenticating the machine but only the domain.

If my account runs out somebody can easily acquire the domain and use e.g. letsencrypt to get a valid certificate. At this point my applications might try to connect to the machine and transmit sensitive data which I would like to avoid.

I assume that doing this in a generic way is impossible but I would be happy about partial solutions that e.g. work only in a Firefox.

The only idea I have so far is to set up a script that will periodically check the certificates and alarm me in some way if they change. That, of course, leaves a window for attacks.

1

It is not fully clear from your description what your problem really is. But it looks for me that you fear that somebody is able to get the ownership of the domain without you realizing this issue. This might be for example because you've failed to extend the domain registration or because of some insecurity at the domain seller or in the protection of your account there.

Based on this fear you then argue that someone is able to setup a server for this domain and get a certificate for it and replicate your content on this new server so that you will not realize that something fishy is going on here and thus will happily enter sensitive data.

The protection in this case is key pinning. With key pinning your browser knows which public key it expects in the certificate and will not connect to the site if the key does not match its expectation - as would be the case if there is a new certificate not owned by you. Key pinning can be setup using the HPKP header.

See this documentation for how to setup your server to provide the HPKP header and how to determine the content of the header.

  • Looking at HPKP. Interesting regardless of if I want to use it. :) – Elias Jun 24 '17 at 7:36
  • I've read up on HPKP and I think this is the correct solution. – Elias Jun 24 '17 at 16:26
1

Could you not buy a domain name, CNAME that to point to your DynDNS. Therefore you use the domain name you just bought, then buy/letsencrypt a SSL certificate for the new domain and use that. (IF you already have a domain name even better just setup a CNAME with that one, personally I would avoid any applications connecting to the DynDNS name as this give you greater flexability in the future should you choose a different dynamic DNS provider, or even get a static IP)

A DV certificate is absolutely fine for this scenario. The other certificates, such as EV, authenticate the company and provide no real advantage in your situation. If you are altra-paranoid about spoofing your domain name then you can always check the public key of the certificate is as expected each time to attempt to connect.

There is also the CAA (Certificate Authority Authorisation) you could apply (Being very new is not widely used, and not in effect technically yet) but worth a read: https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization

  • But I want that check to happen automatically. I don't mind a little setup up front but then it has to be automatic. – Elias Jun 23 '17 at 16:10
  • But you don't need the check. Really you are over complicating it. If you don't trust the connection, then you would never connect to any SSL website. How do you know the bank is real? If you buy a SSL for a domain you own, or even better use LetsEncrypt, then you have the security you need as it has been issued by a trusted CA. – ISMSDEV Jun 23 '17 at 16:12
  • If you are worried about someone with enough intentions of impersonating your domain with a dodgy CA and the ability to man in the middle your SSL for the sake of intercepting your home connection, then you have bigger concerns than that to worry about :) – ISMSDEV Jun 23 '17 at 16:14
  • The issue here is that I want to authenticate my machine and not the domain. If I lose the domain everybody can pick it up and get a valid DV certificate. When I have an EV certificate for my bank that certificate authenticates the bank when I try to connect to it so it makes perfect sense, imho. – Elias Jun 23 '17 at 16:18
  • I gave an answer its up to you whether you feel it helps or not. The whole world uses SSL for exactly your problem. Anyway lets see what others say :) – ISMSDEV Jun 23 '17 at 16:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.