Hacker News Reader

I don't understand why that is such a huge problem. The alternatives have much more severe problems, all from reusing a wildcard in many places to running your own PKI.

View on HN

It depends on your risk profile, but there are definitely people who'd rather run their own PKI than permit threat actor reconnaissance by publishing internal hostnames to CT logs.

When this information is useful you've either got fundamental security related issues that needs to be addressed long before this, or you're dealing with threat actors with significant capabilities. In the latter case you've probably already taking this into account when you're creating your stuff, or you have the capability and technical understanding to know how to properly roll out your own PKI.

The overlap of people that suggest that you either run your own PKI or just distribute a wildcard certificate and have the technical understanding on how to do this in a secure way is minuscule. The rest of those people are probably better off using something like Lets Encrypt.

I still think it's a good idea not to expose more information than necessary, mostly for the reasons we can't think of.

Also I wouldn't be surprised if Let's Encrypt/ZeroSSL were compromised.

It would surprise me if it was, because of features like certificate transparency logs.

Reply on news.ycombinator.com