1

Inspired by this comment from Can DDNS provider perform a MITM attack?, I was wondering if there is an automated way to check the Certificate Transparency logs for malicious/unexpected certificates.

For example, if I run some ACME client on my Linux server (to automatically get certificates from Let's Encrypt), can I install a tool to automatically compare the public CT logs with the log files from my ACME client, to find published certificates that were not requested by my server? And would that actually be a useful way to detect e.g. MITM attacks from my DNS provider?

1

1 Answer 1

0

I don't think Certificate Transparency can help you here. They can get a wildcard certificate for *.ddnsprovider.net (that will end up on the logs), and that certificate would be valid for your server because it's using a subdomain (e.g. yourserver.ddnsprovider.net.

You will be able to get a certificate for yourserver.ddnsprovider.net and get its entry from the certificate transparency logs. You can know if anyone else issues a certificate for yourserver.ddnsprovider.net, but you cannot detect if the wildcard certificate is being used to impersonate your server.

2
  • 1
    But that means that I could check the CT log also for wildcard certificates for *.ddnsprovider.net, right? And if I find one, that would be a reason to be suspicious of that DNS provider, I guess.
    – oliver
    Jun 22 at 7:56
  • I doubt you will find a DDNS provider that doesn't own a wildcard certificate...
    – ThoriumBR
    Jun 22 at 9:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.