Internal CA issues wildcard certificate

Question

Few of our web servers are managed by an outsourced partner who works as us in the same office, uses our laptops connected to our corp network, and has user accounts in our AD. They requested and applied wildcard certificates to make some of the IIS sites (all internal facing) https.

Someone in IT raised a concern that it is not advisable, from a security point of view, that outsourced admins request and apply certs on websites. Here is the argument:

With a wildcard certificate you can "impersonate" any service, even the ones not managed by the specific team on the specific servers they have an agreement to manage. If the certificate is leaked outside of our company, it could pose a security risk, e.g. potentially be used to setup services pretending to be owned/validated by us when they are not. We may have NDA in place, but it would still be good practice IMHO to limit number of hands with access to certificates (I'd say even internal hands!), and considering that we even used pseudo-role based usernames as we expect that people may rotate more often than internal employees.

It is an internal certificate which wouldn't resolve on the internet. What do others think of this?

Answer 1

I'll supplement @schoeder's answer with some technical details.

My understanding of your situation is that you have servers applications like this:

intranet.xyz.abc.com
documents.xyz.abc.com
applications.xyz.abc.com
...

and your partner also has some applications running on the same server:

partner1.xyz.abc.com
partner2.xyz.abc.com

All of the above are internal-facing (not accessible from the internet). Now, the partner was too lazy to make individual certs for each of their IIS applications, so they made and installed a global a cert for:

*.xyz.abc.com

Cool. That covers all of their applications. But it also covers all of yours. Assuming they have access to the private key that belongs to this wildcard cert, then they can Man-in-the-Middle your intranet or documents servers and read all the traffic.

Also, if your company has (or a malicious admin with your partner decides to stand up) any public-facing websites that match the wildcard, for example:

www.xyz.abc.com

then, since it's a private internal CA, the general public would not be fooled by their spoof, but any of your employees connecting from internally (with that CA installed into their OS) would trust the spoofed version of www.xyz.abc.com.

As @schroeder points out, the potential for insider-threat here is huge.

Answer 2

Insider threats are a major problem that not enough organizations think about. The IT person is correct to bring this up.

But the argument is just one factor. A 'threat' has been raised, and now a 'threat analysis' needs to be performed. What is the impact if a malicious insider (outsourced or not) can impersonate services? If this impact is low, then you can choose to ignore this threat.

Just because something could happen does not mean that we need to freak out. We need to consider the impacts and likelihoods and determine if this is something we need to deal with.

Without further details about your environment, services, data flows, etc, (which you probably should not disclose here), that's about as much as we can respond.