Wildcard cert? Or individual subdomain certs?

[Telos]

What are the drawbacks of using wildcard certs?

Obviously setting up a new subdomain which uses an existing wildcard cert, is a few clicks easier, and cert renewal across multiple subdomains is simpler with a wildcard cert.

Are there security issues involved with using an LE wildcard cert, as opposed to managing individual subdomain certs?

 

[fredbert]

An interesting question. I'm wondering how would something malicious benefit from successfully spinning up a virtual host vs would this be worse than just infecting an existing web service's files?

From a client point of view then I guess there is probably more trust that this particular service is the right one if it isn't using a wildcard.

 

[Telos]

I've been using a wildcard cert, primarily on the basis of "oh, isn't that easy", but I've not seen much that addresses its drawbacks... hence the question.

This got me thinking...

And since it is relatively simple to request LE certs for subdomains, I want to take the right path from a security standpoint.

 

[fredbert]

If you read this and the linked report there are examples for why using wildcard certs can be a risk.

Avoid Dangers of Wildcard TLS Certificates, the ALPACA Technique

NSA released the Cybersecurity Information Sheet, “Avoid Dangers of Wildcard TLS Certificates and the ALPACA Technique” today, warning network administrators about the risks of using poorly scoped

www.nsa.gov

For an organisation that has a complex and diverse IT/OT deployment then managing domains and certificates will be an important part of administration. But in a home setup: how complex will it be; what is the reward for compromising the certificate vs just doing a ransomware of data?

Maybe in situations where you are running many secured services [on your NAS] then there is a heightened risk that a service implementation is weak and that could further compromise other services. Whether this means an attack target would be via a shared wildcard certificate, instead of just going around the underlying OS and to other services and data.

Anyway, I use multiple LE certs that have a few alternative names ... because I'm too lazy to manually setup a way to do wildcard cards and manually manage their distribution.

 

[Telos]

Largely my subdomains connect to my NAS' reverse proxy, and then onto a docker container, or other networked device (for example, NAS1, NAS2, NAS3...). In that scenario, all certs, whether wildcard, or individual subdomains, would reside on the primary NAS1 on which the reverse proxy is operating, limiting (?) my security risk to NAS1 ("all eggs in one basket").

Simplistically, I'm unsure whether individual subdomain certs offer added security, when they are all on the same machine.

I'm probably missing something basic with that philosophy...

Relatedly... since Cloudflare assumed management of my wildcard cert, there seems to be no way to prevent the renewal of the wildcard... short of closing my account. What a puzzle.

 

[Rusty]

For an organisation that has a complex and diverse IT/OT deployment then managing domains and certificates will be an important part of administration. But in a home setup: how complex will it be; what is the reward for compromising the certificate vs just doing a ransomware of data?

Maybe in situations where you are running many secured services [on your NAS] then there is a heightened risk that a service implementation is weak and that could further compromise other services. Whether this means an attack target would be via a shared wildcard certificate, instead of just going around the underlying OS and to other services and data.

Personally I would agree with this statement. Coming from a large corporation where using a wild card cert is a huge no (from a security standpoint) we always use dedicated certs per service. Reason is that the they want to minimize the risk by not allowing a cert to compromised that will then effect multiple services all at once.

For a soho setup, and especially every xy months I would still use a wild cert then to tackle 20-30 individual certs for all the services. Security vs convenience I guess.

 

[Telos]

For a soho setup, and especially every xy months I would still use a wild cert then to tackle 20-30 individual certs for all the services

Thanks. For now, I'm staying with the wildcard cert. But I'm giving up on using npm to acquire it. Yesterday I discovered how simple certbot is (and discovered that the wildcard also covers the base domain), using...

sudo certbot --manual --preferred-challenge dns certonly -d *.mydomain.com

Now I need to sort out how to automate this to land the certs in the proper location, and to set a renewal.

 

[jeyare]

wildcard cert always,
just use the Search tool on this forum regarding LE cert issues, and you will get 1000 reasons for the wildcard cert usage.

“nothing is for free”
or
“anything free is worth what you pay for it”