As the name suggests, the value of a Wildcard SSL certificate varies and is determined by its audience. There are several risks associated with this certificate type, says Megan Rehbock, LAWtrust certificate service manager.
Wildcard certificates, which support all subject alternative names associated to a given domain, cannot be seen as the security quick fix they’re popularly considered to be.
Many consumers believe that one size can fit all in their hunt for a cost-effective and easy approach to securing their environments. Wildcards are enabled to cover all domains with the same registered root, that is a certificate associated to .lawtrust.co.za will secure everything, including the LAWtrust domain name, if applied correctly – such as mobile.lawtrust.co.za.
For this reason, users think they can be used as a quick, “one certificate fits all” fix.
While only having a single certificate – with the associated simplicity and flexibility it brings – may make management and administration of an environment easier, it also increases a company’s risk and exposure to fraud and loss. Without proper control and monitoring, wildcards can include fictitious/fraudulent subject alternative names.
Certificates, including their corresponding private key, can be used on multiple servers too, exposing the key. As the key for a specific certificate is relatively easily accessible the risk of eavesdropping is heightened.
A private key can be used to decrypt sensitive traffic, compromising confidential information and data. A SAN for a given domain can also be impersonated and traffic redirected to it, and through it, to an attacker’s server by criminals sending out phishing emails or using IP redirect.
Additionally, in the event that a server or sub-domain is compromised within the certificate, all other applications associated with that certificate will be affected too.
When time comes to renew the certificate all of the instances covered by the original will need to be covered by the new certificate. If the environment has not been managed and monitored correctly this can become an administrative nightmare resulting in system downtime and certificate expiry.
A more efficient and effective approach to SSL certificates, and one which mitigates the company’s risk as far as possible, is to create single stand-alone certificates to cover the company’s SSL requirements, ensuring that each instance has its own unique and corresponding public and private key pair.
Tools such as the Certificate Management Services (CMS) available through Entrust and free from providers like LAWtrust will help improve the administration and management of SSL certificates. These tools feature self-service functions to help streamline the procurement and management of certificates, including reusing them to help minimise costs.