Hello and welcome to the Wednesday, August 30th, 2023 edition of the Sandcent Storm Center's Stormcast.

My name is Johannes Ulrich, and then I'm recording from Jacksonville, Florida.

Boyan today wrote up a little test-hitted, and that was setting up a new website and registering a TLS certificate for it,

and then waiting how long it takes for the website to be actually scanned.

Well, it turns out it only took seconds.

The culprit here is likely certificate transparency.

Now, to make it clear, certificate transparency is a good thing. It forces

certificate authorities to publish certificates that they issue, which you then can search to,

for example, identify certificates that someone may have retrieved for your domain without authorization. All public sort of authorities that

are part of the trusted sort of authority ecosystem have to publish these certificate transparency

logs and that basically ensures that they all sort of play by the same rules. But with these logs being public and relatively

easy to monitor, it's no surprise that various more or less bad guys, some of them are

sort of in our research category, are scanning any new website as it's being deployed. So your survival time here is really only a few

seconds, which of course important because often websites are being made life before the security

configuration of the site is completed. So it is a good reminder. Make sure that anything that you are making life is completely secure.

So don't wait until later. As far certificates go, what I usually recommend is if you have

internal websites, like development websites and such, it may just be not just simpler, but also safer to use an internal

set of authority for these sites. Of course, that only works if only a limited audience needs

to reach the site and for development and internal sites. It may be better to have an

internal set of authority, and of course internal set of authorities don't have to play by these rules and do not have to publish certificate transparency logs.

I have a blog post by the Japanese cert that I must admit I didn't really take quite serious yesterday.

And, well, today I looked at it again after one listener sort of pointed me to it.

...