Hacker News Reader

Comment by arkadiyt | Hacker News Reader

Fantastic summary. For anyone wanting to search CT logs, Sectigo operates https://crt.sh/ for that. For instance here are all non-expired certificates containing a twitter subdomain: https://crt.sh/?Identity=%25.twitter.com&exclude=expired

edit: s/Digicert/Sectigo - thanks jaas

View on HN

It's interesting that CT effectively publishes all of your HTTPS endpoints. Using your example, it's possible to see a bunch of twitter hosts it might be hard to find otherwise. This effect of CT has been surprisingly uncontroversial, in contrast to DNSSEC where enumeration concerns have probably delayed adoption:

https://www.cloudflare.com/dns/dnssec/dnssec-complexities-an...

I suppose you can get around enumeration concerns with CT by using a wildcard cert. It's always seemed odd to me to worry about information in a public database like DNS being retrievable on bulk anyway - that approach is just security by obscurity.

DNSSEC enumeration also exposes all the hosts in your zone, and CT exposes only the hosts with publicly verifiable certificates.

But not everyone uses wildcard certs so enumeration is a problem. Also lots of people use certs with internal hostnames on public servers (they shouldn’t but it does make some things easier and not everyone is aware of the security issues). When CT first came out I remember running searches for some of our client’s domains and being easily able to identify Exchange servers, RDP servers, etc along with the corresponding internal hostnames which makes it easy to identify potential targets for attack.

Obscurity does have a role to play in security - leaving your front door unlocked is unlikely to be a problem but if you publish that information in a publicly searchable database then you are making yourself a target

It is the new "zone transfer" without the IP addresses :)

There are companies that use private (not publicly resolvable) domains for which they create public certificates for internal hosts, that get published via CT.

Nice for OpsSec sleuthing.

Edit: how to find these "private domains"? Often public certificates contain more than one DNS names, of which one might be "private". YMMV

Reply on news.ycombinator.com