Skip to main content

Questions tagged [wildcard]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
5 votes
2 answers
1k views

How did I obtain a wildcard SSL certificate without port 80 opened for a challenge?

I wanted to secure my apps running in a private subnet with SSL. Albeit not necessary, it is very nice to have. Because of my constant changes, I opted for a wildcard ssl certificate through my DNS ...
OutwardThinking's user avatar
1 vote
1 answer
55 views

Does the CORS asteriks / wildcard include both encrypted and unencrypted origins?

Does the CORS asteriks / wildcard (*) include both encrypted (https) and unencrypted origins (http)? And is the null origin (i.e., when a local file is doing a xmlhttprequest, or within an iframe ...
Booger21's user avatar
0 votes
0 answers
2k views

How to search for any file with a specified extension using Gobuster

A website allocates random file names to uploads and I am trying to enumerate through the folder that the files are uploaded to using Gobuster. I know the extension of my file type, but not the file ...
user2334659's user avatar
9 votes
2 answers
3k views

Do subdomains of a TLD with mandatory HTTPS require a wildcard certificate?

Many new TLDs have mandatory HTTPS requirements. Is there a way to disable that for subdomains? If not does that mean an expensive wildcard SSL certificate will need to be used with these domains? So ...
JamesWeir's user avatar
0 votes
0 answers
589 views

How to generate PFX file for Wild Card SSL Certificate using Openssl Command in Linux

I want to generate PFX file for my Wild Card SSL Certificate. I am using below mentioned command to generate the same however getting error message: openssl pkcs12 -export -out ./star_domain_com.pfx -...
linux01's user avatar
0 votes
0 answers
19 views

Should a wildcard cert. e.g. *.example.com, be accepted to authenticate the root domain not listed as SAN? [duplicate]

(This has been marked a duplicate of SSL Cert for sub.domain.com and www.sub.domain.com, but while it's correct that the answer to this question is present in the answers there, that question is ...
Scott's user avatar
  • 165
1 vote
1 answer
2k views

Wildcard Certificates and Client Authentication for Machine Authentication

If a wildcard certificate is provisioned for *.domain.fqdn, and has Client Authentication as a defined usage, does this mean the certificate can be used to essentially impersonate any domain machine? ...
SmithPlatts's user avatar
1 vote
2 answers
2k views

HTTPS IP devices and certificate best practices, why can't I sign a certificate for my local ip device?

I have a IPv4 network behind a pfSense firewall at my small business. We have around 200 IP devices on the network. We have about 30 Axis IP cameras which have MJPG streams embedded into webpages as ...
David Sindar's user avatar
0 votes
1 answer
289 views

Are all web servers for a domain wildcard certificate supposed to have the same private key?

If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it's a short question, but I am not sure of ...
johnny's user avatar
  • 641
0 votes
1 answer
437 views

Securing DNS by blocking querys AND responses [Dnscrypt questions]

Visiting facebook.com you will query s.update.fbsbx.com. s.update.fbsbx.com is a CNAME to s.agentanalytics.com. Currently, the only way to block s.agentanalytics.com is to block s.update.fbsbx.com via ...
Tyler's user avatar
  • 445
1 vote
0 answers
5k views

Creating a PFX File for Wildcard SSL Certificate

I am trying to install a Wildcard SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I got the ....
Rajas's user avatar
  • 41
1 vote
2 answers
2k views

Why does Access-Control-Allow-Headers: * have no effect?

Although the OPTIONS returns * for Allow-Headers I'm getting the following CORS response. Access to XMLHttpRequest at 'https://example1.com' from origin 'https://example2.net' has been blocked by ...
Roee Gavirel's user avatar
2 votes
1 answer
1k views

How do partial wildcards in subjectAltName dNSName interact with IDNA domains?

For instance if I run IDNA encode bücher.tld you receive xn--bcher-kva.tld. Now imagine the certificate for https://bücher.tld has the following field within subjectAltName: (dNSName, xn--bcher*.tld). ...
Seth Larson's user avatar
1 vote
1 answer
534 views

Workaround for no www.subdomain.domain coverage on wildcard cert [closed]

Edit: Would deleting the www.hungry.example.org DNS record be a good solution if there are no links to it? I have a domain (example.org) and a subdomain (hungry.example.org). Until recently they had ...
user1114's user avatar
  • 145
1 vote
1 answer
187 views

Bash wildcards - Manipulate globbing to delete arbitrary files

I am currently auditing a plugin and have the following situation (simplified for example purposes): <?php $post_id = false; $absolute_path = "/var/www/html/wordpress/cache"; $extension = ".min....
Simon Scannell's user avatar
15 votes
2 answers
3k views

Internal CA issues wildcard certificate

Few of our web servers are managed by an outsourced partner who works as us in the same office, uses our laptops connected to our corp network, and has user accounts in our AD. They requested and ...
Manu's user avatar
  • 251
15 votes
4 answers
4k views

Security concerns issuing wildcard certificates to individual employees

We recently setup a two tier internal certificate authority. We also disseminate Root CAs via Active Directory so certificates from our internal CA are automatically trusted by every (Windows) system ...
Brad's user avatar
  • 623
14 votes
3 answers
5k views

Why can't Let's Encrypt support wildcard certificates?

Let's Encrypt claims: We do not offer Organization Validation (OV), Extended Validation (EV), or wildcard certificates, primarily because we cannot automate issuance for those types of certificates....
user541686's user avatar
  • 2,572
1 vote
1 answer
137 views

new wildcard certificate if I already own another certificate for a subdomain

I already own a certificate for a subdomain sub1.domain.com but I would like to secure all subdomains of domain.com buying a wildcard certificate. Can I still use the specific certificate for sub1....
hdcnik's user avatar
  • 13
1 vote
1 answer
1k views

How to ensure wildcard certificate private key security?

The time has come for us to renew and update our wildcard certificate. I've been tasked with researching the ways we can protect the private key without compromising the security of the certificate. (...
bsant's user avatar
  • 11
2 votes
1 answer
838 views

Why no SSL certificate with multiple subdomains [duplicate]

I know that you can't use a SSL wildcard certificate for multiple subdomains. e.g. If I have a certificate for *.example.com I can use it for domains like test.example.com but not for test.test....
Lars's user avatar
  • 121
0 votes
2 answers
1k views

Does any SQL/noSQL server accept * (asterisk) as a wildcard character?

I am testing a website and I found an endpoint that accepts an e-mail address and returns a HTTP 200 response if that e-mail is registered, or 401 if that e-mail is not registered. But I also noticed ...
pineappleman's user avatar
  • 2,299
1 vote
0 answers
20 views

How did I get a signed cert back with a wildcard common name when I submitted a csr with a specific common name? [duplicate]

Apologies if this is obvious but I'm hoping for some clarification here. I generated a CSR on an appliance of mine. This CSR had a specific common name (let's call it foo.domain.com). I then sent ...
Mike B's user avatar
  • 3,468
2 votes
3 answers
4k views

Same wildcard cert from two different 3rd party CA's

We have a wildcard cert that's due to expire in three months. The CA won't let us renew it until one month prior to its expiration. We're thinking about using a different CA since we've since ...
Jeremy's user avatar
  • 21
3 votes
3 answers
6k views

Single Domain SSL Certificate vs Wildcard Certificate

Probably a rather odd question, but something that came to mind. Wildcard certificates are about 10 times more expensive than a single certificate. However with a single certificate, you can secure ...
Alien595's user avatar
8 votes
2 answers
5k views

Is lack of wildcard DNS entry a security vulnerability?

A friend of a friend received an email from a security researcher that looks legit. Researcher submitted several vulnerabilities, one of the them reads like this Vulnerability # ... Title : ...
oleksii's user avatar
  • 1,068
0 votes
0 answers
572 views

Appropriate uses for wildcard certificates

I have a client that wants to use a single Wildcard certificate purchased from a third party CA for the purpose of Server Authentication when connecting to and from AD LDS using SSL and for routing ...
Bill Hurt's user avatar
  • 133
2 votes
1 answer
3k views

What web browsers support ECC vs DSA vs RSA for SSL/TLS?

We are updating our wildcard certificate and see that we have the option to use both RSA or DSA with Symantec (for free), while Digicert offers 3 options for wildcards ECC, DSA and RSA. Is there a ...
makerofthings7's user avatar
0 votes
1 answer
542 views

Combining wildcard and subdomain-specific SSL certificates

Not quite sure which Google terms to use to find the answer, so I thought I'd ask it here, presented as a scenario: Say you have a corporate entity (Example Co) with a wildcard SSL cert issued for *....
ssl-curious's user avatar
1 vote
2 answers
214 views

Is there a Standard Verification process for Certificate Authorities to follow?

So the premise of the question is to quantify the risk of wild card certificates versus regular certificates. From my research the greatest fundamental danger of wild card certificates is the ...
Brett Littrell's user avatar
3 votes
1 answer
505 views

Wildcard DNS entry from a security PoV

We are going to release our new product which will have customers create their own subdomains. This requires having a wildcard DNS on our main domain (We have no other options, right?) Are there any ...
Sreeraj's user avatar
  • 1,355
21 votes
3 answers
12k views

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit?

How many hostnames can be supported by a wildcard ssl certificate? Is there any limit ?
Arun's user avatar
  • 211
0 votes
1 answer
817 views

Save to setup localhost.example.com to test wildcard SSL?

I have a domain with a wildcard SSL certificate (i.e. "*.example.com"). I also develop using WAMP setups, which I would like to be able to test HTTPS on. There are several tutorials on how to setup a ...
Martijn's user avatar
  • 205
0 votes
1 answer
3k views

Self-signed CA and combining wildcard and SAN certificates

I have created my own Certificate Authority and installed the certificate on a few computers. Now I have generated a server certificate with common name *.mydomain.com and Subject Alternative Name (...
Toxiro's user avatar
  • 113
0 votes
1 answer
193 views

Which URL is revealed when using wildcard SSL?

Assume there are two servers; server1.com has a standard SSL certificate installed and server2.com has a wildcard SSL certificate (*.server2.com) installed. Next, assume you make from server 1 via ...
user1402897's user avatar
20 votes
3 answers
24k views

Chrome SSL Warning: "You cannot proceed because the website operator has requested heightened security for this domain. "

I'm trying to go to the URL below, and Chrome warns me that the wildcard certificate is not valid for this domain. https://chart.apis.google.com/chart?cht=qr&chs=100x100&chl=otpauth%3A%2F%...
makerofthings7's user avatar
2 votes
3 answers
784 views

Server Certificates, certificate authority, and servers

I currently have a valid wildcard certificate installed on OS X 10.8.2 server. To make sure we know what I'm talking about the cert is *.domain.com (example only) I'd love to use this to secure as ...
Everett's user avatar
  • 1,506