Collaborate Disseminate
If I have three web servers that all have the same CSR based on a domain, *.domain.com, does that mean all the servers have the same private key? I know it’s a short question, but I am not sure of the SO answers I have read…. Continue reading Are all web servers for a domain wildcard certificate supposed to have the same private key?
Visiting facebook.com you will query s.update.fbsbx.com. s.update.fbsbx.com is a CNAME to s.agentanalytics.com. Currently, the only way to block s.agentanalytics.com is to block s.update.fbsbx.com via hosts. Windows DNS clie… Continue reading Securing DNS by blocking querys AND responses [Dnscrypt questions]
I am trying to install a Wildcard SSL Certificate in IIS on Windows Server. It only accepts the .pfx file format for importing & installing an SSL certificate for hosted applications. I got the .csr file from CA as it was… Continue reading Creating a PFX File for Wildcard SSL Certificate
Although the OPTIONS returns * for Allow-Headers I’m getting the following CORS response.
Access to XMLHttpRequest at ‘https://example1.com’ from origin ‘https://example2.net’ has been blocked by CORS policy: Request header field x-reques… Continue reading Why does Access-Control-Allow-Headers: * have no effect?
I have an issue after Let’s Encrypt Wildcard Certificate installation, maybe somebody can help me.
I have installed a Wildcard certificate generated by sslforfree.com at cPanel.
The domain is fluidpower.pro and at the hosti… Continue reading Let’s Encrypt Wildcard SSL certificate doesn’t match domain name [on hold]
Edit: Would deleting the www.hungry.example.org DNS record be a good solution if there are no links to it?
I have a domain (example.org) and a subdomain (hungry.example.org). Until recently they had separate SSL Certificates… Continue reading Workaround for no www.subdomain.domain coverage on wildcard cert
I am currently auditing a plugin and have the following situation (simplified for example purposes):
<?php
$post_id = false;
$absolute_path = “/var/www/html/wordpress/cache”;
$extension = “.min.css”;
$filename = $_GET[‘f… Continue reading Bash wildcards – Manipulate globbing to delete arbitrary files
What are the best practices to prevent the abuse of Wildcard certificates?
Can measures like restricted access to the domain control panel that is used for creating new A records be useful to get the necessary protection?
Use of wildcard x509 certs is not considered generally a good practice in the security world.
However, lately, I am noticing solutions in cloud require wildcard certs. The logic the providers recommend is mainly the conven… Continue reading Clouds & Wildcard SSL Certs
Few of our web servers are managed by an outsourced partner who works as us in the same office, uses our laptops connected to our corp network, and has user accounts in our AD. They requested and applied wildcard certificates… Continue reading Internal CA issues wildcard certificate