Re: wildcard SSL, is this a bad thing?

[Aarón Mizrachi <unmanarc () gmail com>]

On Jueves 16 Abril 2009 19:52:30 robsonde () gmail com escribió:
> do wildcard SSL cert's have a bigger security risk?
>
> we are building 4 new servers for our internal intranet staff directory.
> we will have a c-name for each server.
>
> this way we can point any c-name at any server for DR and maintance
> outages.
>
> the old system was to have an SSL cert for each server.
> svr1.intranet.company.com
> svr2.intranet.company.com
> svr3.intranet.company.com
> svr4.intranet.company.com
>
> problem is that if we re-point a c-name we will get a SSL cert mis-match.
>
> my plan is to make each server use a wildcard SSL cert of
> *.intranet.company.com I know my solution will solve the problem but is it
> a security risk? is this a bad thing?
>
> what security risks am I opening up?

Not so good. i think that is a medium level security hazard. 

\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\>
why?
what is the real security risk there?

have the same certificate used on a couple sites increase their probability to 
be hacked/obtained, and... then, could involve revoke the certificate on all 
servers.

If you have a weak server "A" used on "non-important" applications (Call it 
weak.intranet.lan), and strong server "B" used on "very-important" operations 
(Call it strong.intranet.lan), then, the SSL security will be strong as the 
weak server.

Then, "strong.intranet.lan" crypto security could be compromised if a non-
important server "weak.intranet.lan" are compromised. (Supposing scheme of 
wildcard: *.intranet.lan).

If the servers are copycats, then, the impact are less so. 

--------------------------------------------------------------------------------------------

What i recommend (a temporary solution)?

Unless the servers are copies, or the domains are managed on the same server, 
(or something similar), you can use multiples ip's by interface, then, dont 
use CNAMES, only A records. 

Internally on the server, redirect both ip's with two distinct certificates 
according to the A record to the same application/website/whatever.

This is a partial tmp solution.

> thanks
>
> ------------------------------------------------------------------------
> This list is sponsored by: InfoSec Institute
>
> Find the source of cybercrime! Almost every crime today involves a computer
> or mobile device. Learn how to become a Computer Forensics Examiner in
> InfoSec Institute's hands-on Computer Forensics Course. Up to three
> industry recognized certs available, online computer forensics training
> available.
>
> http://www.infosecinstitute.com/courses/computer_forensics_training.html
> ------------------------------------------------------------------------


------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Learn all of the latest penetration testing techniques in InfoSec Institute's Ethical Hacking class.
Totally hands-on course with evening Capture The Flag (CTF) exercises, Certified Ethical Hacker and Certified 
Penetration Tester exams, taught by an expert with years of real pen testing experience.

http://www.infosecinstitute.com/courses/ethical_hacking_training.html
------------------------------------------------------------------------