3

I work with an application and the main site has a CA issued wildcard certificate for *.example.com.

We have several public facing subdomains eg app.example.com / cdn.example.com and several dev / qa environments eg. qa.example.com which are not available without being behind the corporate firewall.

Investigating a mixed content issue I was starting to talk to the network guys about trusted root certs and group policy for the dev boxes when I noticed that the main cert was a wildcard cert. Which leads me on to the question:

Are there any negative security implications by asking to have the public certificate imported onto the dev boxes?

4

You are not just importing the public certificate. You are also importing the private key that belongs to it.

I think the main implication is that you will be giving an untold number of dev and qa people access to the production server's private key. That means with a quick file copy, they can go home and do man-in-the-middle or phishing attacks against your user base.

Apart from insider threat, since I assume your dev and qa environments have less security hardening than your prod environment, you are also lowering the bar for hackers to steal the prod server's private key . For example, a compromised dev machine (say from an email attachment) probably has an easier time accessing the qa system than the prod system.

Better to have your prod system and dev / qa systems using different private keys.

  • Thanks for the answer...it was very informative. I was under the impression that the private key would also be secured by a password. I vaguely remember having to know a password to install some sort of cert in the past. I realised that it would be possible to obtain it, but thought it would be harder than just copying a file. – ste-fu Nov 27 '17 at 23:07
  • @ste-fu Do you need to type the password every time you reboot the server? If so, then your dev / qa people will know it, and also an attacker can plant a keylogger and wait for someone to type it after a reboot. If not, then in order for the server to unlock the key automatically, the password must be stored somewhere on the server, right? Presumably devs have root access to the dev / qa boxes? Think like a hacker! – Mike Ounsworth Nov 27 '17 at 23:29
  • Yeah...I think I'm getting confused with installing some other certificate or signing process. Insider threat is a big issue but one that takes a long time to fix. I hadn't considered the risk from compromising dev machines and moving onto the servers. Thanks for your help. – ste-fu Nov 28 '17 at 0:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.